WIP - twilio integration

backend/migrations/tenant/20250129000001_add_authorization_system.js

@@ -0,0 +1,103 @@
+exports.up = function (knex) {
+  return knex.schema
+    // Add orgWideDefault to object_definitions
+    .alterTable('object_definitions', (table) => {
+      table
+        .enum('orgWideDefault', ['private', 'public_read', 'public_read_write'])
+        .defaultTo('private')
+        .notNullable();
+    })
+    // Create role_object_permissions table
+    .createTable('role_object_permissions', (table) => {
+      table.uuid('id').primary().defaultTo(knex.raw('(UUID())'));
+      table.uuid('roleId').notNullable();
+      table.uuid('objectDefinitionId').notNullable();
+      table.boolean('canCreate').defaultTo(false);
+      table.boolean('canRead').defaultTo(false);
+      table.boolean('canEdit').defaultTo(false);
+      table.boolean('canDelete').defaultTo(false);
+      table.boolean('canViewAll').defaultTo(false);
+      table.boolean('canModifyAll').defaultTo(false);
+      table.timestamps(true, true);
+
+      table
+        .foreign('roleId')
+        .references('id')
+        .inTable('roles')
+        .onDelete('CASCADE');
+      table
+        .foreign('objectDefinitionId')
+        .references('id')
+        .inTable('object_definitions')
+        .onDelete('CASCADE');
+      table.unique(['roleId', 'objectDefinitionId']);
+      table.index(['roleId']);
+      table.index(['objectDefinitionId']);
+    })
+    // Create role_field_permissions table
+    .createTable('role_field_permissions', (table) => {
+      table.uuid('id').primary().defaultTo(knex.raw('(UUID())'));
+      table.uuid('roleId').notNullable();
+      table.uuid('fieldDefinitionId').notNullable();
+      table.boolean('canRead').defaultTo(true);
+      table.boolean('canEdit').defaultTo(true);
+      table.timestamps(true, true);
+
+      table
+        .foreign('roleId')
+        .references('id')
+        .inTable('roles')
+        .onDelete('CASCADE');
+      table
+        .foreign('fieldDefinitionId')
+        .references('id')
+        .inTable('field_definitions')
+        .onDelete('CASCADE');
+      table.unique(['roleId', 'fieldDefinitionId']);
+      table.index(['roleId']);
+      table.index(['fieldDefinitionId']);
+    })
+    // Create record_shares table for sharing specific records
+    .createTable('record_shares', (table) => {
+      table.uuid('id').primary().defaultTo(knex.raw('(UUID())'));
+      table.uuid('objectDefinitionId').notNullable();
+      table.uuid('recordId').notNullable();
+      table.uuid('granteeUserId').notNullable();
+      table.uuid('grantedByUserId').notNullable();
+      table.json('accessLevel').notNullable(); // { canRead, canEdit, canDelete }
+      table.timestamp('expiresAt').nullable();
+      table.timestamp('revokedAt').nullable();
+      table.timestamp('createdAt').defaultTo(knex.fn.now());
+      table.timestamp('updatedAt').defaultTo(knex.fn.now());
+
+      table
+        .foreign('objectDefinitionId')
+        .references('id')
+        .inTable('object_definitions')
+        .onDelete('CASCADE');
+      table
+        .foreign('granteeUserId')
+        .references('id')
+        .inTable('users')
+        .onDelete('CASCADE');
+      table
+        .foreign('grantedByUserId')
+        .references('id')
+        .inTable('users')
+        .onDelete('CASCADE');
+      table.index(['objectDefinitionId', 'recordId']);
+      table.index(['granteeUserId']);
+      table.index(['expiresAt']);
+      table.index(['revokedAt']);
+    });
+};
+
+exports.down = function (knex) {
+  return knex.schema
+    .dropTableIfExists('record_shares')
+    .dropTableIfExists('role_field_permissions')
+    .dropTableIfExists('role_object_permissions')
+    .alterTable('object_definitions', (table) => {
+      table.dropColumn('orgWideDefault');
+    });
+};

backend/migrations/tenant/20250203000001_create_calls_table.js

@@ -0,0 +1,55 @@
+/**
+ * @param { import("knex").Knex } knex
+ * @returns { Promise<void> }
+ */
+exports.up = async function (knex) {
+  // Create calls table for tracking voice calls
+  await knex.schema.createTable('calls', (table) => {
+    table.string('id', 36).primary();
+    table.string('call_sid', 100).unique().notNullable().comment('Twilio call SID');
+    table.enum('direction', ['inbound', 'outbound']).notNullable();
+    table.string('from_number', 20).notNullable();
+    table.string('to_number', 20).notNullable();
+    table.enum('status', [
+      'queued',
+      'ringing',
+      'in-progress',
+      'completed',
+      'busy',
+      'failed',
+      'no-answer',
+      'canceled'
+    ]).notNullable().defaultTo('queued');
+    table.integer('duration_seconds').unsigned().nullable();
+    table.string('recording_url', 500).nullable();
+    table.text('ai_transcript').nullable().comment('Full transcript from OpenAI');
+    table.text('ai_summary').nullable().comment('AI-generated summary');
+    table.json('ai_insights').nullable().comment('Structured insights from AI');
+    table.string('user_id', 36).notNullable().comment('User who handled the call');
+    table.timestamp('started_at').nullable();
+    table.timestamp('ended_at').nullable();
+    table.timestamp('created_at').defaultTo(knex.fn.now());
+    table.timestamp('updated_at').defaultTo(knex.fn.now());
+
+    // Indexes
+    table.index('call_sid');
+    table.index('user_id');
+    table.index('status');
+    table.index('direction');
+    table.index(['created_at', 'user_id']);
+
+    // Foreign key to users table
+    table.foreign('user_id').references('id').inTable('users').onDelete('CASCADE');
+  });
+
+  console.log('✅ Created calls table');
+};
+
+/**
+ * @param { import("knex").Knex } knex
+ * @returns { Promise<void> }
+ */
+exports.down = async function (knex) {
+  await knex.schema.dropTableIfExists('calls');
+  console.log('✅ Dropped calls table');
+};

backend/package.json

@@ -26,6 +26,8 @@
     "migrate:all-tenants": "ts-node -r tsconfig-paths/register scripts/migrate-all-tenants.ts"
   },
   "dependencies": {
+    "@casl/ability": "^6.7.5",
+    "@fastify/websocket": "^11.2.0",
     "@nestjs/bullmq": "^10.1.0",
     "@nestjs/common": "^10.3.0",
     "@nestjs/config": "^3.1.1",
@@ -33,6 +35,8 @@
     "@nestjs/jwt": "^10.2.0",
     "@nestjs/passport": "^10.0.3",
     "@nestjs/platform-fastify": "^10.3.0",
+    "@nestjs/platform-socket.io": "^10.4.20",
+    "@nestjs/websockets": "^10.4.20",
     "@prisma/client": "^5.8.0",
     "bcrypt": "^5.1.1",
     "bullmq": "^5.1.0",
@@ -42,10 +46,14 @@
     "knex": "^3.1.0",
     "mysql2": "^3.15.3",
     "objection": "^3.1.5",
+    "openai": "^6.15.0",
     "passport": "^0.7.0",
     "passport-jwt": "^4.0.1",
     "reflect-metadata": "^0.2.1",
-    "rxjs": "^7.8.1"
+    "rxjs": "^7.8.1",
+    "socket.io": "^4.8.3",
+    "twilio": "^5.11.1",
+    "ws": "^8.18.3"
   },
   "devDependencies": {
     "@nestjs/cli": "^10.3.0",

backend/prisma/migrations/20260103054426_add_integrations_config/migration.sql

@@ -0,0 +1,2 @@
+-- AlterTable
+ALTER TABLE `tenants` ADD COLUMN `integrationsConfig` JSON NULL;

backend/prisma/schema-central.prisma

@@ -32,6 +32,7 @@ model Tenant {
   dbName             String   // Database name
   dbUsername         String   // Database username
   dbPassword         String   // Encrypted database password
+  integrationsConfig Json?    // Encrypted JSON config for external services (Twilio, OpenAI, etc.)
   status             String   @default("active") // active, suspended, deleted
   createdAt          DateTime @default(now())
   updatedAt          DateTime @updatedAt

backend/scripts/seed-default-roles.ts

@@ -0,0 +1,181 @@
+import { Knex } from 'knex';
+import * as knexLib from 'knex';
+
+/**
+ * Create a Knex connection for tenant database
+ */
+function createKnexConnection(database: string): Knex {
+  return knexLib.default({
+    client: 'mysql2',
+    connection: {
+      host: process.env.DB_HOST || 'db',
+      port: parseInt(process.env.DB_PORT || '3306'),
+      user: 'root',
+      password: 'asjdnfqTash37faggT',
+      database: database,
+    },
+  });
+}
+
+interface RoleWithPermissions {
+  name: string;
+  description: string;
+  objectPermissions: {
+    [objectApiName: string]: {
+      canCreate: boolean;
+      canRead: boolean;
+      canEdit: boolean;
+      canDelete: boolean;
+      canViewAll: boolean;
+      canModifyAll: boolean;
+    };
+  };
+}
+
+const DEFAULT_ROLES: RoleWithPermissions[] = [
+  {
+    name: 'System Administrator',
+    description: 'Full access to all objects and records. Can view and modify all data.',
+    objectPermissions: {
+      '*': {
+        canCreate: true,
+        canRead: true,
+        canEdit: true,
+        canDelete: true,
+        canViewAll: true,
+        canModifyAll: true,
+      },
+    },
+  },
+  {
+    name: 'Standard User',
+    description: 'Can create, read, edit, and delete own records. Respects OWD settings.',
+    objectPermissions: {
+      '*': {
+        canCreate: true,
+        canRead: true,
+        canEdit: true,
+        canDelete: true,
+        canViewAll: false,
+        canModifyAll: false,
+      },
+    },
+  },
+  {
+    name: 'Read Only',
+    description: 'Can only read records based on OWD settings. No create, edit, or delete.',
+    objectPermissions: {
+      '*': {
+        canCreate: false,
+        canRead: true,
+        canEdit: false,
+        canDelete: false,
+        canViewAll: false,
+        canModifyAll: false,
+      },
+    },
+  },
+];
+
+async function seedRolesForTenant(knex: Knex, tenantName: string) {
+  console.log(`\n🌱 Seeding roles for tenant: ${tenantName}`);
+
+  // Get all object definitions
+  const objectDefinitions = await knex('object_definitions').select('id', 'apiName');
+
+  for (const roleData of DEFAULT_ROLES) {
+    // Check if role already exists
+    const existingRole = await knex('roles')
+      .where({ name: roleData.name })
+      .first();
+
+    let roleId: string;
+
+    if (existingRole) {
+      console.log(`   ℹ️  Role "${roleData.name}" already exists, skipping...`);
+      roleId = existingRole.id;
+    } else {
+      // Create role
+      await knex('roles').insert({
+        name: roleData.name,
+        guardName: 'api',
+        description: roleData.description,
+      });
+
+      // Get the inserted role
+      const newRole = await knex('roles')
+        .where({ name: roleData.name })
+        .first();
+
+      roleId = newRole.id;
+      console.log(`   ✅ Created role: ${roleData.name}`);
+    }
+
+    // Create object permissions for all objects
+    const wildcardPermissions = roleData.objectPermissions['*'];
+    
+    for (const objectDef of objectDefinitions) {
+      // Check if permission already exists
+      const existingPermission = await knex('role_object_permissions')
+        .where({
+          roleId: roleId,
+          objectDefinitionId: objectDef.id,
+        })
+        .first();
+
+      if (!existingPermission) {
+        await knex('role_object_permissions').insert({
+          roleId: roleId,
+          objectDefinitionId: objectDef.id,
+          canCreate: wildcardPermissions.canCreate,
+          canRead: wildcardPermissions.canRead,
+          canEdit: wildcardPermissions.canEdit,
+          canDelete: wildcardPermissions.canDelete,
+          canViewAll: wildcardPermissions.canViewAll,
+          canModifyAll: wildcardPermissions.canModifyAll,
+        });
+      }
+    }
+
+    console.log(`   📋 Set permissions for ${objectDefinitions.length} objects`);
+  }
+}
+
+async function seedAllTenants() {
+  console.log('🚀 Starting role seeding for all tenants...\n');
+
+  // For now, seed the main tenant database
+  const databases = ['tenant_tenant1'];
+
+  let successCount = 0;
+  let errorCount = 0;
+
+  for (const database of databases) {
+    try {
+      const knex = createKnexConnection(database);
+      await seedRolesForTenant(knex, database);
+      await knex.destroy();
+      successCount++;
+    } catch (error) {
+      console.error(`❌ ${database}: Seeding failed:`, error.message);
+      errorCount++;
+    }
+  }
+
+  console.log('\n============================================================');
+  console.log('📊 Seeding Summary');
+  console.log('============================================================');
+  console.log(`✅ Successful: ${successCount}`);
+  console.log(`❌ Failed: ${errorCount}`);
+
+  if (errorCount === 0) {
+    console.log('\n🎉 All tenant roles seeded successfully!');
+  }
+}
+
+seedAllTenants()
+  .then(() => process.exit(0))
+  .catch((error) => {
+    console.error('Unhandled error:', error);
+    process.exit(1);
+  });

backend/src/app.module.ts

@@ -7,6 +7,7 @@ import { RbacModule } from './rbac/rbac.module';
 import { ObjectModule } from './object/object.module';
 import { AppBuilderModule } from './app-builder/app-builder.module';
 import { PageLayoutModule } from './page-layout/page-layout.module';
+import { VoiceModule } from './voice/voice.module';
 
 @Module({
   imports: [
@@ -20,6 +21,7 @@ import { PageLayoutModule } from './page-layout/page-layout.module';
     ObjectModule,
     AppBuilderModule,
     PageLayoutModule,
+    VoiceModule,
   ],
 })
 export class AppModule {}

backend/src/main.ts

@@ -9,7 +9,7 @@ import { AppModule } from './app.module';
 async function bootstrap() {
   const app = await NestFactory.create<NestFastifyApplication>(
     AppModule,
-    new FastifyAdapter(),
+    new FastifyAdapter({ logger: false }),
   );
 
   // Global validation pipe

backend/src/models/field-definition.model.ts

@@ -74,5 +74,13 @@ export class FieldDefinition extends BaseModel {
         to: 'object_definitions.id',
       },
     },
+    rolePermissions: {
+      relation: BaseModel.HasManyRelation,
+      modelClass: () => require('./role-field-permission.model').RoleFieldPermission,
+      join: {
+        from: 'field_definitions.id',
+        to: 'role_field_permissions.fieldDefinitionId',
+      },
+    },
   };
 }

backend/src/models/object-definition.model.ts

@@ -10,8 +10,11 @@ export class ObjectDefinition extends BaseModel {
   description?: string;
   isSystem: boolean;
   isCustom: boolean;
+  orgWideDefault: 'private' | 'public_read' | 'public_read_write';
   createdAt: Date;
   updatedAt: Date;
+  fields?: any[];
+  rolePermissions?: any[];
 
   static get jsonSchema() {
     return {
@@ -25,12 +28,14 @@ export class ObjectDefinition extends BaseModel {
         description: { type: 'string' },
         isSystem: { type: 'boolean' },
         isCustom: { type: 'boolean' },
+        orgWideDefault: { type: 'string', enum: ['private', 'public_read', 'public_read_write'] },
       },
     };
   }
 
   static get relationMappings() {
     const { FieldDefinition } = require('./field-definition.model');
+    const { RoleObjectPermission } = require('./role-object-permission.model');
 
     return {
       fields: {
@@ -41,6 +46,14 @@ export class ObjectDefinition extends BaseModel {
           to: 'field_definitions.objectDefinitionId',
         },
       },
+      rolePermissions: {
+        relation: BaseModel.HasManyRelation,
+        modelClass: RoleObjectPermission,
+        join: {
+          from: 'object_definitions.id',
+          to: 'role_object_permissions.objectDefinitionId',
+        },
+      },
     };
   }
 }

backend/src/models/record-share.model.ts

@@ -0,0 +1,113 @@
+import { BaseModel } from './base.model';
+
+export interface RecordShareAccessLevel {
+  canRead: boolean;
+  canEdit: boolean;
+  canDelete: boolean;
+}
+
+export class RecordShare extends BaseModel {
+  static tableName = 'record_shares';
+
+  // Don't use snake_case mapping since DB columns are already camelCase
+  static get columnNameMappers() {
+    return {
+      parse(obj: any) {
+        return obj;
+      },
+      format(obj: any) {
+        return obj;
+      },
+    };
+  }
+
+  // Don't auto-set timestamps - let DB defaults handle them
+  $beforeInsert() {
+    // Don't call super - skip BaseModel's timestamp logic
+  }
+
+  $beforeUpdate() {
+    // Don't call super - skip BaseModel's timestamp logic
+  }
+
+  id!: string;
+  objectDefinitionId!: string;
+  recordId!: string;
+  granteeUserId!: string;
+  grantedByUserId!: string;
+  accessLevel!: RecordShareAccessLevel;
+  expiresAt?: Date;
+  revokedAt?: Date;
+  createdAt!: Date;
+  updatedAt!: Date;
+
+  static get jsonSchema() {
+    return {
+      type: 'object',
+      required: ['objectDefinitionId', 'recordId', 'granteeUserId', 'grantedByUserId', 'accessLevel'],
+      properties: {
+        id: { type: 'string' },
+        objectDefinitionId: { type: 'string' },
+        recordId: { type: 'string' },
+        granteeUserId: { type: 'string' },
+        grantedByUserId: { type: 'string' },
+        accessLevel: {
+          type: 'object',
+          properties: {
+            canRead: { type: 'boolean' },
+            canEdit: { type: 'boolean' },
+            canDelete: { type: 'boolean' },
+          },
+        },
+        expiresAt: {
+          anyOf: [
+            { type: 'string', format: 'date-time' },
+            { type: 'null' },
+            { type: 'object' } // Allow Date objects
+          ]
+        },
+        revokedAt: {
+          anyOf: [
+            { type: 'string', format: 'date-time' },
+            { type: 'null' },
+            { type: 'object' } // Allow Date objects
+          ]
+        },
+        createdAt: { type: ['string', 'object'], format: 'date-time' },
+        updatedAt: { type: ['string', 'object'], format: 'date-time' },
+      },
+    };
+  }
+
+  static get relationMappings() {
+    const { ObjectDefinition } = require('./object-definition.model');
+    const { User } = require('./user.model');
+
+    return {
+      objectDefinition: {
+        relation: BaseModel.BelongsToOneRelation,
+        modelClass: ObjectDefinition,
+        join: {
+          from: 'record_shares.objectDefinitionId',
+          to: 'object_definitions.id',
+        },
+      },
+      granteeUser: {
+        relation: BaseModel.BelongsToOneRelation,
+        modelClass: User,
+        join: {
+          from: 'record_shares.granteeUserId',
+          to: 'users.id',
+        },
+      },
+      grantedByUser: {
+        relation: BaseModel.BelongsToOneRelation,
+        modelClass: User,
+        join: {
+          from: 'record_shares.grantedByUserId',
+          to: 'users.id',
+        },
+      },
+    };
+  }
+}

backend/src/models/role-field-permission.model.ts

@@ -0,0 +1,51 @@
+import { BaseModel } from './base.model';
+
+export class RoleFieldPermission extends BaseModel {
+  static tableName = 'role_field_permissions';
+
+  id!: string;
+  roleId!: string;
+  fieldDefinitionId!: string;
+  canRead!: boolean;
+  canEdit!: boolean;
+  createdAt!: Date;
+  updatedAt!: Date;
+
+  static get jsonSchema() {
+    return {
+      type: 'object',
+      required: ['roleId', 'fieldDefinitionId'],
+      properties: {
+        id: { type: 'string' },
+        roleId: { type: 'string' },
+        fieldDefinitionId: { type: 'string' },
+        canRead: { type: 'boolean' },
+        canEdit: { type: 'boolean' },
+      },
+    };
+  }
+
+  static get relationMappings() {
+    const { Role } = require('./role.model');
+    const { FieldDefinition } = require('./field-definition.model');
+
+    return {
+      role: {
+        relation: BaseModel.BelongsToOneRelation,
+        modelClass: Role,
+        join: {
+          from: 'role_field_permissions.roleId',
+          to: 'roles.id',
+        },
+      },
+      fieldDefinition: {
+        relation: BaseModel.BelongsToOneRelation,
+        modelClass: FieldDefinition,
+        join: {
+          from: 'role_field_permissions.fieldDefinitionId',
+          to: 'field_definitions.id',
+        },
+      },
+    };
+  }
+}

backend/src/models/role-object-permission.model.ts

@@ -0,0 +1,59 @@
+import { BaseModel } from './base.model';
+
+export class RoleObjectPermission extends BaseModel {
+  static tableName = 'role_object_permissions';
+
+  id!: string;
+  roleId!: string;
+  objectDefinitionId!: string;
+  canCreate!: boolean;
+  canRead!: boolean;
+  canEdit!: boolean;
+  canDelete!: boolean;
+  canViewAll!: boolean;
+  canModifyAll!: boolean;
+  createdAt!: Date;
+  updatedAt!: Date;
+
+  static get jsonSchema() {
+    return {
+      type: 'object',
+      required: ['roleId', 'objectDefinitionId'],
+      properties: {
+        id: { type: 'string' },
+        roleId: { type: 'string' },
+        objectDefinitionId: { type: 'string' },
+        canCreate: { type: 'boolean' },
+        canRead: { type: 'boolean' },
+        canEdit: { type: 'boolean' },
+        canDelete: { type: 'boolean' },
+        canViewAll: { type: 'boolean' },
+        canModifyAll: { type: 'boolean' },
+      },
+    };
+  }
+
+  static get relationMappings() {
+    const { Role } = require('./role.model');
+    const { ObjectDefinition } = require('./object-definition.model');
+
+    return {
+      role: {
+        relation: BaseModel.BelongsToOneRelation,
+        modelClass: Role,
+        join: {
+          from: 'role_object_permissions.roleId',
+          to: 'roles.id',
+        },
+      },
+      objectDefinition: {
+        relation: BaseModel.BelongsToOneRelation,
+        modelClass: ObjectDefinition,
+        join: {
+          from: 'role_object_permissions.objectDefinitionId',
+          to: 'object_definitions.id',
+        },
+      },
+    };
+  }
+}

backend/src/models/role.model.ts

@@ -27,6 +27,8 @@ export class Role extends BaseModel {
     const { RolePermission } = require('./role-permission.model');
     const { Permission } = require('./permission.model');
     const { User } = require('./user.model');
+    const { RoleObjectPermission } = require('./role-object-permission.model');
+    const { RoleFieldPermission } = require('./role-field-permission.model');
 
     return {
       rolePermissions: {
@@ -61,6 +63,22 @@ export class Role extends BaseModel {
           to: 'users.id',
         },
       },
+      objectPermissions: {
+        relation: BaseModel.HasManyRelation,
+        modelClass: RoleObjectPermission,
+        join: {
+          from: 'roles.id',
+          to: 'role_object_permissions.roleId',
+        },
+      },
+      fieldPermissions: {
+        relation: BaseModel.HasManyRelation,
+        modelClass: RoleFieldPermission,
+        join: {
+          from: 'roles.id',
+          to: 'role_field_permissions.roleId',
+        },
+      },
     };
   }
 }

backend/src/object/models/base.model.ts

@@ -1,4 +1,5 @@
 import { Model } from 'objection';
+import { randomUUID } from 'crypto';
 
 /**
  * Base model for all dynamic and system models
@@ -10,26 +11,23 @@ export class BaseModel extends Model {
   tenantId?: string;
   ownerId?: string;
   name?: string;
-  created_at?: Date;
-  updated_at?: Date;
+  created_at?: string;
+  updated_at?: string;
 
   // Hook to set system-managed fields
-  $beforeInsert() {
-    // created_at and updated_at are handled by the database
-    // ownerId should be set by the controller/service
+  async $beforeInsert() {
+    if (!this.id) {
+      this.id = randomUUID();
     }
-
-  $beforeUpdate() {
-    // updated_at is handled by the database
+    if (!this.created_at) {
+      this.created_at = new Date().toISOString().slice(0, 19).replace('T', ' ');
     }
-
-
-
-  /**
-   * Get the API name for this object
-   * Override in subclasses
-   */
-  static get objectApiName(): string {
-    return 'BaseModel';
+    if (!this.updated_at) {
+      this.updated_at = new Date().toISOString().slice(0, 19).replace('T', ' ');
+    }
+  }
+
+  async $beforeUpdate() {
+    this.updated_at = new Date().toISOString().slice(0, 19).replace('T', ' ');
   }
 }

backend/src/object/models/dynamic-model.factory.ts

@@ -1,4 +1,3 @@
-import { randomUUID } from 'crypto';
 import { ModelClass, JSONSchema, RelationMappings, Model } from 'objection';
 import { BaseModel } from './base.model';
 
@@ -28,6 +27,14 @@ export interface ObjectMetadata {
 }
 
 export class DynamicModelFactory {
+  /**
+   * Get relation name from lookup field API name
+   * Converts "ownerId" -> "owner", "customFieldId" -> "customfield"
+   */
+  static getRelationName(lookupFieldApiName: string): string {
+    return lookupFieldApiName.replace(/Id$/, '').toLowerCase();
+  }
+
   /**
    * Create a dynamic model class from object metadata
    * @param meta Object metadata
@@ -49,7 +56,8 @@ export class DynamicModelFactory {
       updated_at: { type: 'string', format: 'date-time' },
     };
 
-    const required: string[] = ['id', 'tenantId'];
+    // Don't require id or tenantId - they'll be set automatically
+    const required: string[] = [];
 
     // Add custom fields
     for (const field of fields) {
@@ -68,20 +76,13 @@ export class DynamicModelFactory {
     // Store lookup fields metadata for later use
     const lookupFieldsInfo = lookupFields.map(f => ({
       apiName: f.apiName,
-      relationName: f.apiName.replace(/Id$/, '').toLowerCase(),
+      relationName: DynamicModelFactory.getRelationName(f.apiName),
       referenceObject: f.referenceObject,
       targetTable: this.getTableName(f.referenceObject),
     }));
 
-    // Create the dynamic model class extending Model directly
-    class DynamicModel extends Model {
-      id?: string;
-      tenantId?: string;
-      ownerId?: string;
-      name?: string;
-      created_at?: string;
-      updated_at?: string;
-
+    // Create the dynamic model class extending BaseModel
+    class DynamicModel extends BaseModel {
       static tableName = tableName;
 
       static objectApiName = apiName;
@@ -128,22 +129,6 @@ export class DynamicModelFactory {
           properties,
         };
       }
-
-      async $beforeInsert() {
-        if (!this.id) {
-          this.id = randomUUID();
-        }
-        if (!this.created_at) {
-          this.created_at = new Date().toISOString();
-        }
-        if (!this.updated_at) {
-          this.updated_at = new Date().toISOString();
-        }
-      }
-
-      async $beforeUpdate() {
-        this.updated_at = new Date().toISOString();
-      }
     }
 
     return DynamicModel as any;

backend/src/object/object.module.ts

@@ -6,11 +6,12 @@ import { SchemaManagementService } from './schema-management.service';
 import { FieldMapperService } from './field-mapper.service';
 import { TenantModule } from '../tenant/tenant.module';
 import { MigrationModule } from '../migration/migration.module';
+import { RbacModule } from '../rbac/rbac.module';
 import { ModelRegistry } from './models/model.registry';
 import { ModelService } from './models/model.service';
 
 @Module({
-  imports: [TenantModule, MigrationModule],
+  imports: [TenantModule, MigrationModule, RbacModule],
   providers: [
     ObjectService,
     SchemaManagementService,

backend/src/object/object.service.ts

@@ -2,6 +2,10 @@ import { Injectable, NotFoundException, Logger } from '@nestjs/common';
 import { TenantDatabaseService } from '../tenant/tenant-database.service';
 import { CustomMigrationService } from '../migration/custom-migration.service';
 import { ModelService } from './models/model.service';
+import { AuthorizationService } from '../rbac/authorization.service';
+import { ObjectDefinition } from '../models/object-definition.model';
+import { FieldDefinition } from '../models/field-definition.model';
+import { User } from '../models/user.model';
 import { ObjectMetadata } from './models/dynamic-model.factory';
 
 @Injectable()
@@ -12,6 +16,7 @@ export class ObjectService {
     private tenantDbService: TenantDatabaseService,
     private customMigrationService: CustomMigrationService,
     private modelService: ModelService,
+    private authService: AuthorizationService,
   ) {}
 
   // Setup endpoints - Object metadata management
@@ -225,6 +230,31 @@ export class ObjectService {
     return objectDef;
   }
 
+  async updateObjectDefinition(
+    tenantId: string,
+    objectApiName: string,
+    data: Partial<{
+      label: string;
+      pluralLabel: string;
+      description: string;
+      orgWideDefault: 'private' | 'public_read' | 'public_read_write';
+    }>,
+  ) {
+    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
+    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
+    
+    // Update the object definition
+    await ObjectDefinition.query(knex)
+      .findOne({ apiName: objectApiName })
+      .patch({
+        ...data,
+        updatedAt: new Date(),
+      });
+    
+    // Return updated object
+    return await ObjectDefinition.query(knex)
+      .findOne({ apiName: objectApiName });
+  }
 
   async createFieldDefinition(
     tenantId: string,
@@ -418,23 +448,44 @@ export class ObjectService {
     const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
     const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
     
-    // Verify object exists and get field definitions
-    const objectDef = await this.getObjectDefinition(tenantId, objectApiName);
+    // Get user with roles and permissions
+    const user = await User.query(knex)
+      .findById(userId)
+      .withGraphFetched('[roles.[objectPermissions, fieldPermissions]]');
+    
+    if (!user) {
+      throw new NotFoundException('User not found');
+    }
+    
+    // Get object definition with authorization settings
+    const objectDefModel = await ObjectDefinition.query(knex)
+      .findOne({ apiName: objectApiName })
+      .withGraphFetched('fields');
+    
+    if (!objectDefModel) {
+      throw new NotFoundException(`Object ${objectApiName} not found`);
+    }
     
     const tableName = this.getTableName(objectApiName);
     
-    // Ensure model is registered before attempting to use it
+    // Ensure model is registered
     await this.ensureModelRegistered(resolvedTenantId, objectApiName);
 
-    // Try to use the Objection model if available
-    try {
-      const Model = this.modelService.getModel(resolvedTenantId, objectApiName);
-      if (Model) {
+    // Use Objection model
     const boundModel = await this.modelService.getBoundModel(resolvedTenantId, objectApiName);
     let query = boundModel.query();
     
+    // Apply authorization scope (modifies query in place)
+    await this.authService.applyScopeToQuery(
+      query,
+      objectDefModel,
+      user,
+      'read',
+      knex,
+    );
+    
     // Build graph expression for lookup fields
-        const lookupFields = objectDef.fields?.filter(f => 
+    const lookupFields = objectDefModel.fields?.filter(f => 
       f.type === 'LOOKUP' && f.referenceObject
     ) || [];
     
@@ -450,80 +501,21 @@ export class ObjectService {
       }
     }
     
-        // Add ownership filter if ownerId field exists
-        const hasOwner = await knex.schema.hasColumn(tableName, 'ownerId');
-        if (hasOwner) {
-          query = query.where({ ownerId: userId });
-        }
-        
     // Apply additional filters
     if (filters) {
       query = query.where(filters);
     }
     
-        return query.select('*');
-      }
-    } catch (error) {
-      this.logger.warn(`Could not use Objection model for ${objectApiName}, falling back to manual join: ${error.message}`);
-    }
+    const records = await query.select('*');
     
-    // Fallback to manual data hydration
-    let query = knex(tableName);
-    
-    // Add ownership filter if ownerId field exists
-    const hasOwner = await knex.schema.hasColumn(tableName, 'ownerId');
-    if (hasOwner) {
-      query = query.where({ [`${tableName}.ownerId`]: userId });
-    }
-    
-    // Apply additional filters
-    if (filters) {
-      query = query.where(filters);
-    }
-    
-    // Get base records
-    const records = await query.select(`${tableName}.*`);
-    
-    // Fetch and attach related records for lookup fields
-    const lookupFields = objectDef.fields?.filter(f => 
-      f.type === 'LOOKUP' && f.referenceObject
-    ) || [];
-    
-    if (lookupFields.length > 0 && records.length > 0) {
-      for (const field of lookupFields) {
-        const relationName = field.apiName.replace(/Id$/, '').toLowerCase();
-        const relatedTable = this.getTableName(field.referenceObject);
-        
-        // Get unique IDs to fetch
-        const relatedIds = [...new Set(
-          records
-            .map(r => r[field.apiName])
-            .filter(Boolean)
-        )];
-        
-        if (relatedIds.length > 0) {
-          // Fetch all related records in one query
-          const relatedRecords = await knex(relatedTable)
-            .whereIn('id', relatedIds)
-            .select('*');
-          
-          // Create a map for quick lookup
-          const relatedMap = new Map(
-            relatedRecords.map(r => [r.id, r])
+    // Filter fields based on field-level permissions
+    const filteredRecords = await Promise.all(
+      records.map(record => 
+        this.authService.filterReadableFields(record, objectDefModel.fields, user)
+      )
     );
     
-          // Attach related records to main records
-          for (const record of records) {
-            const relatedId = record[field.apiName];
-            if (relatedId && relatedMap.has(relatedId)) {
-              record[relationName] = relatedMap.get(relatedId);
-            }
-          }
-        }
-      }
-    }
-    
-    return records;
+    return filteredRecords;
   }
 
   async getRecord(
@@ -535,23 +527,42 @@ export class ObjectService {
     const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
     const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
     
-    // Verify object exists and get field definitions
-    const objectDef = await this.getObjectDefinition(tenantId, objectApiName);
+    // Get user with roles and permissions
+    const user = await User.query(knex)
+      .findById(userId)
+      .withGraphFetched('[roles.[objectPermissions, fieldPermissions]]');
     
-    const tableName = this.getTableName(objectApiName);
+    if (!user) {
+      throw new NotFoundException('User not found');
+    }
     
-    // Ensure model is registered before attempting to use it
+    // Get object definition with authorization settings
+    const objectDefModel = await ObjectDefinition.query(knex)
+      .findOne({ apiName: objectApiName })
+      .withGraphFetched('fields');
+    
+    if (!objectDefModel) {
+      throw new NotFoundException(`Object ${objectApiName} not found`);
+    }
+    
+    // Ensure model is registered
     await this.ensureModelRegistered(resolvedTenantId, objectApiName);
     
-    // Try to use the Objection model if available
-    try {
-      const Model = this.modelService.getModel(resolvedTenantId, objectApiName);
-      if (Model) {
+    // Use Objection model
     const boundModel = await this.modelService.getBoundModel(resolvedTenantId, objectApiName);
     let query = boundModel.query().where({ id: recordId });
     
+    // Apply authorization scope (modifies query in place)
+    await this.authService.applyScopeToQuery(
+      query,
+      objectDefModel,
+      user,
+      'read',
+      knex,
+    );
+    
     // Build graph expression for lookup fields
-        const lookupFields = objectDef.fields?.filter(f => 
+    const lookupFields = objectDefModel.fields?.filter(f => 
       f.type === 'LOOKUP' && f.referenceObject
     ) || [];
     
@@ -567,62 +578,15 @@ export class ObjectService {
       }
     }
     
-        // Add ownership filter if ownerId field exists
-        const hasOwner = await knex.schema.hasColumn(tableName, 'ownerId');
-        if (hasOwner) {
-          query = query.where({ ownerId: userId });
-        }
-        
     const record = await query.first();
     if (!record) {
       throw new NotFoundException('Record not found');
     }
-        return record;
-      }
-    } catch (error) {
-      this.logger.warn(`Could not use Objection model for ${objectApiName}, falling back to manual join: ${error.message}`);
-    }
     
-    // Fallback to manual data hydration
-    let query = knex(tableName).where({ [`${tableName}.id`]: recordId });
+    // Filter fields based on field-level permissions
+    const filteredRecord = await this.authService.filterReadableFields(record, objectDefModel.fields, user);
     
-    // Add ownership filter if ownerId field exists
-    const hasOwner = await knex.schema.hasColumn(tableName, 'ownerId');
-    if (hasOwner) {
-      query = query.where({ [`${tableName}.ownerId`]: userId });
-    }
-    
-    const record = await query.first();
-    
-    if (!record) {
-      throw new NotFoundException('Record not found');
-    }
-    
-    // Fetch and attach related records for lookup fields
-    const lookupFields = objectDef.fields?.filter(f => 
-      f.type === 'LOOKUP' && f.referenceObject
-    ) || [];
-    
-    if (lookupFields.length > 0) {
-      for (const field of lookupFields) {
-        const relationName = field.apiName.replace(/Id$/, '').toLowerCase();
-        const relatedTable = this.getTableName(field.referenceObject);
-        const relatedId = record[field.apiName];
-        
-        if (relatedId) {
-          // Fetch the related record
-          const relatedRecord = await knex(relatedTable)
-            .where({ id: relatedId })
-            .first();
-          
-          if (relatedRecord) {
-            record[relationName] = relatedRecord;
-          }
-        }
-      }
-    }
-    
-    return record;
+    return filteredRecord;
   }
 
   async createRecord(
@@ -634,47 +598,45 @@ export class ObjectService {
     const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
     const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
     
-    // Verify object exists
-    await this.getObjectDefinition(tenantId, objectApiName);
+    // Get user with roles and permissions
+    const user = await User.query(knex)
+      .findById(userId)
+      .withGraphFetched('[roles.[objectPermissions, fieldPermissions]]');
     
-    // Ensure model is registered before attempting to use it
+    if (!user) {
+      throw new NotFoundException('User not found');
+    }
+    
+    // Get object definition with authorization settings
+    const objectDefModel = await ObjectDefinition.query(knex)
+      .findOne({ apiName: objectApiName })
+      .withGraphFetched('fields');
+    
+    if (!objectDefModel) {
+      throw new NotFoundException(`Object ${objectApiName} not found`);
+    }
+    
+    // Check if user has create permission
+    const canCreate = await this.authService.canCreate(objectDefModel, user);
+    if (!canCreate) {
+      throw new NotFoundException('You do not have permission to create records of this object');
+    }
+    
+    // Filter data to only editable fields
+    const editableData = await this.authService.filterEditableFields(data, objectDefModel.fields, user);
+    
+    // Ensure model is registered
     await this.ensureModelRegistered(resolvedTenantId, objectApiName);
     
-    // Try to use the Objection model if available
-    try {
-      const Model = this.modelService.getModel(resolvedTenantId, objectApiName);
-      if (Model) {
+    // Use Objection model
     const boundModel = await this.modelService.getBoundModel(resolvedTenantId, objectApiName);
     const recordData = {
-          ...data,
+      ...editableData,
       ownerId: userId, // Auto-set owner
     };
     const record = await boundModel.query().insert(recordData);
     return record;
   }
-    } catch (error) {
-      console.warn(`Could not use Objection model for ${objectApiName}:`, error.message);
-    }
-    
-    // Fallback to raw Knex if model not available
-    const tableName = this.getTableName(objectApiName);
-    const hasOwner = await knex.schema.hasColumn(tableName, 'ownerId');
-    
-    const recordData: any = {
-      id: knex.raw('(UUID())'),
-      ...data,
-      created_at: knex.fn.now(),
-      updated_at: knex.fn.now(),
-    };
-    
-    if (hasOwner) {
-      recordData.ownerId = userId;
-    }
-    
-    const [id] = await knex(tableName).insert(recordData);
-    
-    return knex(tableName).where({ id }).first();
-  }
 
   async updateRecord(
     tenantId: string,
@@ -686,40 +648,52 @@ export class ObjectService {
     const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
     const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
     
-    // Verify object exists and user has access
-    await this.getRecord(tenantId, objectApiName, recordId, userId);
+    // Get user with roles and permissions
+    const user = await User.query(knex)
+      .findById(userId)
+      .withGraphFetched('[roles.[objectPermissions, fieldPermissions]]');
+    
+    if (!user) {
+      throw new NotFoundException('User not found');
+    }
+    
+    // Get object definition with authorization settings
+    const objectDefModel = await ObjectDefinition.query(knex)
+      .findOne({ apiName: objectApiName })
+      .withGraphFetched('fields');
+    
+    if (!objectDefModel) {
+      throw new NotFoundException(`Object ${objectApiName} not found`);
+    }
     
     const tableName = this.getTableName(objectApiName);
     
-    // Ensure model is registered before attempting to use it
+    // Get existing record
+    const existingRecord = await knex(tableName).where({ id: recordId }).first();
+    if (!existingRecord) {
+      throw new NotFoundException('Record not found');
+    }
+    
+    // Check if user can update this record
+    await this.authService.assertCanPerformAction('update', objectDefModel, existingRecord, user, knex);
+    
+    // Filter data to only editable fields
+    const editableData = await this.authService.filterEditableFields(data, objectDefModel.fields, user);
+    
+    // Remove system fields
+    delete editableData.id;
+    delete editableData.ownerId;
+    delete editableData.created_at;
+    delete editableData.tenantId;
+
+    // Ensure model is registered
     await this.ensureModelRegistered(resolvedTenantId, objectApiName);
 
-    // Try to use the Objection model if available
-    try {
-      const Model = this.modelService.getModel(resolvedTenantId, objectApiName);
-      if (Model) {
+    // Use Objection model
     const boundModel = await this.modelService.getBoundModel(resolvedTenantId, objectApiName);
-        // Don't allow updating ownerId or system fields
-        const allowedData = { ...data };
-        delete allowedData.ownerId;
-        delete allowedData.id;
-        delete allowedData.created_at;
-        delete allowedData.tenantId;
-        
-        await boundModel.query().where({ id: recordId }).update(allowedData);
+    await boundModel.query().where({ id: recordId }).update(editableData);
     return boundModel.query().where({ id: recordId }).first();
   }
-    } catch (error) {
-      console.warn(`Could not use Objection model for ${objectApiName}:`, error.message);
-    }
-    
-    // Fallback to raw Knex
-    await knex(tableName)
-      .where({ id: recordId })
-      .update({ ...data, updated_at: knex.fn.now() });
-    
-    return knex(tableName).where({ id: recordId }).first();
-  }
 
   async deleteRecord(
     tenantId: string,
@@ -730,28 +704,198 @@ export class ObjectService {
     const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
     const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
     
-    // Verify object exists and user has access
-    await this.getRecord(tenantId, objectApiName, recordId, userId);
+    // Get user with roles and permissions
+    const user = await User.query(knex)
+      .findById(userId)
+      .withGraphFetched('[roles.[objectPermissions, fieldPermissions]]');
+    
+    if (!user) {
+      throw new NotFoundException('User not found');
+    }
+    
+    // Get object definition with authorization settings
+    const objectDefModel = await ObjectDefinition.query(knex)
+      .findOne({ apiName: objectApiName });
+    
+    if (!objectDefModel) {
+      throw new NotFoundException(`Object ${objectApiName} not found`);
+    }
     
     const tableName = this.getTableName(objectApiName);
     
-    // Ensure model is registered before attempting to use it
+    // Get existing record
+    const existingRecord = await knex(tableName).where({ id: recordId }).first();
+    if (!existingRecord) {
+      throw new NotFoundException('Record not found');
+    }
+    
+    // Check if user can delete this record
+    await this.authService.assertCanPerformAction('delete', objectDefModel, existingRecord, user, knex);
+
+    // Ensure model is registered
     await this.ensureModelRegistered(resolvedTenantId, objectApiName);
 
-    // Try to use the Objection model if available
-    try {
-      const Model = this.modelService.getModel(resolvedTenantId, objectApiName);
-      if (Model) {
+    // Use Objection model
     const boundModel = await this.modelService.getBoundModel(resolvedTenantId, objectApiName);
     await boundModel.query().where({ id: recordId }).delete();
+    
     return { success: true };
   }
-    } catch (error) {
-      console.warn(`Could not use Objection model for ${objectApiName}:`, error.message);
+
+  async getFieldPermissions(tenantId: string, objectId: string) {
+    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
+    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
+    
+    // Get all field permissions for this object's fields
+    const permissions = await knex('role_field_permissions as rfp')
+      .join('field_definitions as fd', 'fd.id', 'rfp.fieldDefinitionId')
+      .where('fd.objectDefinitionId', objectId)
+      .select('rfp.*');
+    
+    return permissions;
   }
 
-    // Fallback to raw Knex
-    await knex(tableName).where({ id: recordId }).delete();
+  async updateFieldPermission(
+    tenantId: string,
+    roleId: string,
+    fieldDefinitionId: string,
+    canRead: boolean,
+    canEdit: boolean,
+  ) {
+    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
+    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
+    
+    // Check if permission already exists
+    const existing = await knex('role_field_permissions')
+      .where({ roleId, fieldDefinitionId })
+      .first();
+    
+    if (existing) {
+      // Update existing permission
+      await knex('role_field_permissions')
+        .where({ roleId, fieldDefinitionId })
+        .update({
+          canRead,
+          canEdit,
+          updated_at: knex.fn.now(),
+        });
+    } else {
+      // Create new permission
+      await knex('role_field_permissions').insert({
+        id: knex.raw('(UUID())'),
+        roleId,
+        fieldDefinitionId,
+        canRead,
+        canEdit,
+        created_at: knex.fn.now(),
+        updated_at: knex.fn.now(),
+      });
+    }
+    
+    return { success: true };
+  }
+
+  async getObjectPermissions(
+    tenantId: string,
+    objectApiName: string,
+    roleId: string,
+  ) {
+    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
+    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
+    
+    // Get object definition
+    const objectDef = await ObjectDefinition.query(knex)
+      .findOne({ apiName: objectApiName });
+    
+    if (!objectDef) {
+      throw new NotFoundException(`Object ${objectApiName} not found`);
+    }
+    
+    // Get role object permissions
+    const permission = await knex('role_object_permissions')
+      .where({ roleId, objectDefinitionId: objectDef.id })
+      .first();
+    
+    if (!permission) {
+      // Return default permissions (all false)
+      return {
+        canCreate: false,
+        canRead: false,
+        canEdit: false,
+        canDelete: false,
+        canViewAll: false,
+        canModifyAll: false,
+      };
+    }
+    
+    return {
+      canCreate: Boolean(permission.canCreate),
+      canRead: Boolean(permission.canRead),
+      canEdit: Boolean(permission.canEdit),
+      canDelete: Boolean(permission.canDelete),
+      canViewAll: Boolean(permission.canViewAll),
+      canModifyAll: Boolean(permission.canModifyAll),
+    };
+  }
+
+  async updateObjectPermissions(
+    tenantId: string,
+    objectApiName: string,
+    data: {
+      roleId: string;
+      canCreate: boolean;
+      canRead: boolean;
+      canEdit: boolean;
+      canDelete: boolean;
+      canViewAll: boolean;
+      canModifyAll: boolean;
+    },
+  ) {
+    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
+    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
+    
+    // Get object definition
+    const objectDef = await ObjectDefinition.query(knex)
+      .findOne({ apiName: objectApiName });
+    
+    if (!objectDef) {
+      throw new NotFoundException(`Object ${objectApiName} not found`);
+    }
+    
+    // Check if permission already exists
+    const existing = await knex('role_object_permissions')
+      .where({ roleId: data.roleId, objectDefinitionId: objectDef.id })
+      .first();
+    
+    if (existing) {
+      // Update existing permission
+      await knex('role_object_permissions')
+        .where({ roleId: data.roleId, objectDefinitionId: objectDef.id })
+        .update({
+          canCreate: data.canCreate,
+          canRead: data.canRead,
+          canEdit: data.canEdit,
+          canDelete: data.canDelete,
+          canViewAll: data.canViewAll,
+          canModifyAll: data.canModifyAll,
+          updated_at: knex.fn.now(),
+        });
+    } else {
+      // Create new permission
+      await knex('role_object_permissions').insert({
+        id: knex.raw('(UUID())'),
+        roleId: data.roleId,
+        objectDefinitionId: objectDef.id,
+        canCreate: data.canCreate,
+        canRead: data.canRead,
+        canEdit: data.canEdit,
+        canDelete: data.canDelete,
+        canViewAll: data.canViewAll,
+        canModifyAll: data.canModifyAll,
+        created_at: knex.fn.now(),
+        updated_at: knex.fn.now(),
+      });
+    }
     
     return { success: true };
   }

backend/src/object/setup-object.controller.ts

@@ -2,6 +2,8 @@ import {
   Controller,
   Get,
   Post,
+  Patch,
+  Put,
   Param,
   Body,
   UseGuards,
@@ -10,6 +12,7 @@ import { ObjectService } from './object.service';
 import { FieldMapperService } from './field-mapper.service';
 import { JwtAuthGuard } from '../auth/jwt-auth.guard';
 import { TenantId } from '../tenant/tenant.decorator';
+import { TenantDatabaseService } from '../tenant/tenant-database.service';
 
 @Controller('setup/objects')
 @UseGuards(JwtAuthGuard)
@@ -17,6 +20,7 @@ export class SetupObjectController {
   constructor(
     private objectService: ObjectService,
     private fieldMapperService: FieldMapperService,
+    private tenantDbService: TenantDatabaseService,
   ) {}
 
   @Get()
@@ -67,4 +71,56 @@ export class SetupObjectController {
     // Map the created field to frontend format
     return this.fieldMapperService.mapFieldToDTO(field);
   }
+
+  @Patch(':objectApiName')
+  async updateObjectDefinition(
+    @TenantId() tenantId: string,
+    @Param('objectApiName') objectApiName: string,
+    @Body() data: any,
+  ) {
+    return this.objectService.updateObjectDefinition(tenantId, objectApiName, data);
+  }
+
+  @Get(':objectId/field-permissions')
+  async getFieldPermissions(
+    @TenantId() tenantId: string,
+    @Param('objectId') objectId: string,
+  ) {
+    return this.objectService.getFieldPermissions(tenantId, objectId);
+  }
+
+  @Put(':objectId/field-permissions')
+  async updateFieldPermission(
+    @TenantId() tenantId: string,
+    @Param('objectId') objectId: string,
+    @Body() data: { roleId: string; fieldDefinitionId: string; canRead: boolean; canEdit: boolean },
+  ) {
+    return this.objectService.updateFieldPermission(tenantId, data.roleId, data.fieldDefinitionId, data.canRead, data.canEdit);
+  }
+
+  @Get(':objectApiName/permissions/:roleId')
+  async getObjectPermissions(
+    @TenantId() tenantId: string,
+    @Param('objectApiName') objectApiName: string,
+    @Param('roleId') roleId: string,
+  ) {
+    return this.objectService.getObjectPermissions(tenantId, objectApiName, roleId);
+  }
+
+  @Put(':objectApiName/permissions')
+  async updateObjectPermissions(
+    @TenantId() tenantId: string,
+    @Param('objectApiName') objectApiName: string,
+    @Body() data: { 
+      roleId: string;
+      canCreate: boolean;
+      canRead: boolean;
+      canEdit: boolean;
+      canDelete: boolean;
+      canViewAll: boolean;
+      canModifyAll: boolean;
+    },
+  ) {
+    return this.objectService.updateObjectPermissions(tenantId, objectApiName, data);
+  }
 }

backend/src/rbac/ability.factory.ts

@@ -0,0 +1,198 @@
+import { AbilityBuilder, PureAbility, AbilityClass } from '@casl/ability';
+import { Injectable } from '@nestjs/common';
+import { User } from '../models/user.model';
+import { RoleObjectPermission } from '../models/role-object-permission.model';
+import { RoleFieldPermission } from '../models/role-field-permission.model';
+import { RecordShare } from '../models/record-share.model';
+
+// Define action types
+export type Action = 'create' | 'read' | 'update' | 'delete' | 'view_all' | 'modify_all';
+
+// Define subject types - can be string (object API name) or actual object with fields
+export type Subject = string | { objectApiName: string; ownerId?: string; id?: string; [key: string]: any };
+
+// Define field actions
+export type FieldAction = 'read' | 'edit';
+
+export type AppAbility = PureAbility<[Action, Subject], { field?: string }>;
+
+@Injectable()
+export class AbilityFactory {
+  /**
+   * Build CASL ability for a user based on their roles and permissions
+   * This aggregates permissions from all roles the user has
+   */
+  async defineAbilityFor(
+    user: User & { roles?: Array<{ objectPermissions?: RoleObjectPermission[]; fieldPermissions?: RoleFieldPermission[] }> },
+    recordShares?: RecordShare[],
+  ): Promise<AppAbility> {
+    const { can, cannot, build } = new AbilityBuilder<AppAbility>(PureAbility as AbilityClass<AppAbility>);
+
+    if (!user.roles || user.roles.length === 0) {
+      // No roles = no permissions
+      return build();
+    }
+
+    // Aggregate object permissions from all roles
+    const objectPermissionsMap = new Map<string, {
+      canCreate: boolean;
+      canRead: boolean;
+      canEdit: boolean;
+      canDelete: boolean;
+      canViewAll: boolean;
+      canModifyAll: boolean;
+    }>();
+
+    // Aggregate field permissions from all roles
+    const fieldPermissionsMap = new Map<string, {
+      canRead: boolean;
+      canEdit: boolean;
+    }>();
+
+    // Process all roles
+    for (const role of user.roles) {
+      // Aggregate object permissions
+      if (role.objectPermissions) {
+        for (const perm of role.objectPermissions) {
+          const existing = objectPermissionsMap.get(perm.objectDefinitionId) || {
+            canCreate: false,
+            canRead: false,
+            canEdit: false,
+            canDelete: false,
+            canViewAll: false,
+            canModifyAll: false,
+          };
+
+          // Union of permissions (if any role grants it, user has it)
+          objectPermissionsMap.set(perm.objectDefinitionId, {
+            canCreate: existing.canCreate || perm.canCreate,
+            canRead: existing.canRead || perm.canRead,
+            canEdit: existing.canEdit || perm.canEdit,
+            canDelete: existing.canDelete || perm.canDelete,
+            canViewAll: existing.canViewAll || perm.canViewAll,
+            canModifyAll: existing.canModifyAll || perm.canModifyAll,
+          });
+        }
+      }
+
+      // Aggregate field permissions
+      if (role.fieldPermissions) {
+        for (const perm of role.fieldPermissions) {
+          const existing = fieldPermissionsMap.get(perm.fieldDefinitionId) || {
+            canRead: false,
+            canEdit: false,
+          };
+
+          fieldPermissionsMap.set(perm.fieldDefinitionId, {
+            canRead: existing.canRead || perm.canRead,
+            canEdit: existing.canEdit || perm.canEdit,
+          });
+        }
+      }
+    }
+
+    // Convert aggregated permissions to CASL rules
+    for (const [objectId, perms] of objectPermissionsMap) {
+      // Create permission
+      if (perms.canCreate) {
+        can('create', objectId);
+      }
+
+      // Read permission
+      if (perms.canRead) {
+        can('read', objectId);
+      }
+
+      // View all permission (can see all records regardless of ownership)
+      if (perms.canViewAll) {
+        can('view_all', objectId);
+      }
+
+      // Edit permission
+      if (perms.canEdit) {
+        can('update', objectId);
+      }
+
+      // Modify all permission (can edit all records regardless of ownership)
+      if (perms.canModifyAll) {
+        can('modify_all', objectId);
+      }
+
+      // Delete permission
+      if (perms.canDelete) {
+        can('delete', objectId);
+      }
+    }
+
+    // Add record sharing permissions
+    if (recordShares) {
+      for (const share of recordShares) {
+        // Only add if share is active (not expired, not revoked)
+        const now = new Date();
+        const isExpired = share.expiresAt && share.expiresAt < now;
+        const isRevoked = share.revokedAt !== null;
+
+        if (!isExpired && !isRevoked) {
+          // Note: Record-level sharing will be checked in authorization service
+          // CASL abilities are primarily for object-level permissions
+          // Individual record access is validated in applyScopeToQuery
+        }
+      }
+    }
+
+    return build();
+  }
+
+  /**
+   * Check if user can access a specific field
+   * Returns true if user has permission or if no restriction exists
+   */
+  canAccessField(
+    fieldDefinitionId: string,
+    action: FieldAction,
+    user: User & { roles?: Array<{ fieldPermissions?: RoleFieldPermission[] }> },
+  ): boolean {
+    if (!user.roles || user.roles.length === 0) {
+      return false;
+    }
+
+    // Collect all field permissions from all roles
+    const allFieldPermissions: RoleFieldPermission[] = [];
+    for (const role of user.roles) {
+      if (role.fieldPermissions) {
+        allFieldPermissions.push(...role.fieldPermissions);
+      }
+    }
+
+    // If there are NO field permissions configured at all, allow by default
+    if (allFieldPermissions.length === 0) {
+      return true;
+    }
+
+    // If field permissions exist, check for explicit grants (union of all roles)
+    for (const role of user.roles) {
+      if (role.fieldPermissions) {
+        const fieldPerm = role.fieldPermissions.find(fp => fp.fieldDefinitionId === fieldDefinitionId);
+        if (fieldPerm) {
+          if (action === 'read' && fieldPerm.canRead) return true;
+          if (action === 'edit' && fieldPerm.canEdit) return true;
+        }
+      }
+    }
+
+    // Field permissions exist but this field is not explicitly granted → deny
+    return false;
+  }
+
+  /**
+   * Filter fields based on user permissions
+   * Returns array of field IDs the user can access with the specified action
+   */
+  filterFields(
+    fieldDefinitionIds: string[],
+    action: FieldAction,
+    user: User & { roles?: Array<{ fieldPermissions?: RoleFieldPermission[] }> },
+  ): string[] {
+    return fieldDefinitionIds.filter(fieldId => this.canAccessField(fieldId, action, user));
+  }
+}

backend/src/rbac/authorization.service.ts

@@ -0,0 +1,282 @@
+import { Injectable, ForbiddenException } from '@nestjs/common';
+import { Knex } from 'knex';
+import { User } from '../models/user.model';
+import { ObjectDefinition } from '../models/object-definition.model';
+import { FieldDefinition } from '../models/field-definition.model';
+import { RecordShare } from '../models/record-share.model';
+import { AbilityFactory, AppAbility, Action } from './ability.factory';
+import { DynamicModelFactory } from '../object/models/dynamic-model.factory';
+import { subject } from '@casl/ability';
+
+@Injectable()
+export class AuthorizationService {
+  constructor(private abilityFactory: AbilityFactory) {}
+
+  /**
+   * Apply authorization scope to a query based on OWD and user permissions
+   * This determines which records the user can see
+   * Modifies the query in place and returns void
+   */
+  async applyScopeToQuery<T = any>(
+    query: any, // Accept both Knex and Objection query builders
+    objectDef: ObjectDefinition,
+    user: User & { roles?: any[] },
+    action: Action,
+    knex: Knex,
+  ): Promise<void> {
+    // Get user's ability
+    const recordShares = await this.getActiveRecordShares(objectDef.id, user.id, knex);
+    const ability = await this.abilityFactory.defineAbilityFor(user, recordShares);
+
+    // Check if user has the base permission for this action
+    // Use object ID, not API name, since permissions are stored by object ID
+    if (!ability.can(action, objectDef.id)) {
+      // No permission at all - return empty result
+      query.where(knex.raw('1 = 0'));
+      return;
+    }
+
+    // Check special permissions
+    const hasViewAll = ability.can('view_all', objectDef.id);
+    const hasModifyAll = ability.can('modify_all', objectDef.id);
+
+    // If user has view_all or modify_all, they can see all records
+    if (hasViewAll || hasModifyAll) {
+      // No filtering needed
+      return;
+    }
+
+    // Apply OWD (Org-Wide Default) restrictions
+    switch (objectDef.orgWideDefault) {
+      case 'public_read_write':
+        // Everyone can see all records
+        return;
+
+      case 'public_read':
+        // Everyone can see all records (write operations checked separately)
+        return;
+
+      case 'private':
+      default:
+        // Only owner and explicitly shared records
+        await this.applyPrivateScope(query, objectDef, user, recordShares, knex);
+        return;
+    }
+  }
+
+  /**
+   * Apply private scope: owner + shared records
+   */
+  private async applyPrivateScope<T = any>(
+    query: any, // Accept both Knex and Objection query builders
+    objectDef: ObjectDefinition,
+    user: User,
+    recordShares: RecordShare[],
+    knex: Knex,
+  ): Promise<void> {
+    const tableName = this.getTableName(objectDef.apiName);
+    
+    // Check if table has ownerId column
+    const hasOwner = await knex.schema.hasColumn(tableName, 'ownerId');
+
+    if (!hasOwner && recordShares.length === 0) {
+      // No ownership and no shares - user can't see anything
+      query.where(knex.raw('1 = 0'));
+      return;
+    }
+
+    // Build conditions: ownerId = user OR record shared with user
+    query.where((builder) => {
+      if (hasOwner) {
+        builder.orWhere(`${tableName}.ownerId`, user.id);
+      }
+
+      if (recordShares.length > 0) {
+        const sharedRecordIds = recordShares.map(share => share.recordId);
+        builder.orWhereIn(`${tableName}.id`, sharedRecordIds);
+      }
+    });
+  }
+
+  /**
+   * Check if user can perform action on a specific record
+   */
+  async canPerformAction(
+    action: Action,
+    objectDef: ObjectDefinition,
+    record: any,
+    user: User & { roles?: any[] },
+    knex: Knex,
+  ): Promise<boolean> {
+    const recordShares = await this.getActiveRecordShares(objectDef.id, user.id, knex);
+    const ability = await this.abilityFactory.defineAbilityFor(user, recordShares);
+
+    // Check base permission - use object ID not API name
+    if (!ability.can(action, objectDef.id)) {
+      return false;
+    }
+
+    // Check special permissions - use object ID not API name
+    const hasViewAll = ability.can('view_all', objectDef.id);
+    const hasModifyAll = ability.can('modify_all', objectDef.id);
+
+    // canViewAll only grants read access to all records
+    if (action === 'read' && hasViewAll) {
+      return true;
+    }
+
+    // canModifyAll grants edit/delete access to all records
+    if ((action === 'update' || action === 'delete') && hasModifyAll) {
+      return true;
+    }
+
+    // Check OWD
+    switch (objectDef.orgWideDefault) {
+      case 'public_read_write':
+        return true;
+
+      case 'public_read':
+        if (action === 'read') return true;
+        // For write actions, check ownership
+        return record.ownerId === user.id;
+
+      case 'private':
+      default:
+        // Check ownership
+        if (record.ownerId === user.id) return true;
+
+        // Check if record is shared with user
+        const share = recordShares.find(s => s.recordId === record.id);
+        if (share) {
+          if (action === 'read' && share.accessLevel.canRead) return true;
+          if (action === 'update' && share.accessLevel.canEdit) return true;
+          if (action === 'delete' && share.accessLevel.canDelete) return true;
+        }
+
+        return false;
+    }
+  }
+
+  /**
+   * Filter data based on field-level permissions
+   * Removes fields the user cannot read
+   */
+  async filterReadableFields(
+    data: any,
+    fields: FieldDefinition[],
+    user: User & { roles?: any[] },
+  ): Promise<any> {
+    const filtered: any = {};
+
+    // Always include id - it's required for navigation and record identification
+    if (data.id !== undefined) {
+      filtered.id = data.id;
+    }
+
+    for (const field of fields) {
+      if (this.abilityFactory.canAccessField(field.id, 'read', user)) {
+        if (data[field.apiName] !== undefined) {
+          filtered[field.apiName] = data[field.apiName];
+        }
+        
+        // For lookup fields, also include the related object (e.g., ownerId -> owner)
+        if (field.type === 'LOOKUP') {
+          const relationName = DynamicModelFactory.getRelationName(field.apiName);
+          if (data[relationName] !== undefined) {
+            filtered[relationName] = data[relationName];
+          }
+        }
+      }
+    }
+
+    return filtered;
+  }
+
+  /**
+   * Filter data based on field-level permissions
+   * Removes fields the user cannot edit
+   */
+  async filterEditableFields(
+    data: any,
+    fields: FieldDefinition[],
+    user: User & { roles?: any[] },
+  ): Promise<any> {
+    const filtered: any = {};
+
+    for (const field of fields) {
+      if (this.abilityFactory.canAccessField(field.id, 'edit', user)) {
+        if (data[field.apiName] !== undefined) {
+          filtered[field.apiName] = data[field.apiName];
+        }
+      }
+    }
+
+    return filtered;
+  }
+
+  /**
+   * Get active record shares for a user on an object
+   */
+  private async getActiveRecordShares(
+    objectDefinitionId: string,
+    userId: string,
+    knex: Knex,
+  ): Promise<RecordShare[]> {
+    const now = new Date();
+
+    return await RecordShare.query(knex)
+      .where('objectDefinitionId', objectDefinitionId)
+      .where('granteeUserId', userId)
+      .whereNull('revokedAt')
+      .where((builder) => {
+        builder.whereNull('expiresAt').orWhere('expiresAt', '>', now);
+      });
+  }
+
+  /**
+   * Check if user has permission to create records
+   */
+  async canCreate(
+    objectDef: ObjectDefinition,
+    user: User & { roles?: any[] },
+  ): Promise<boolean> {
+    const ability = await this.abilityFactory.defineAbilityFor(user, []);
+    return ability.can('create', objectDef.id);
+  }
+
+  /**
+   * Throw exception if user cannot perform action
+   */
+  async assertCanPerformAction(
+    action: Action,
+    objectDef: ObjectDefinition,
+    record: any,
+    user: User & { roles?: any[] },
+    knex: Knex,
+  ): Promise<void> {
+    const can = await this.canPerformAction(action, objectDef, record, user, knex);
+    if (!can) {
+      throw new ForbiddenException(`You do not have permission to ${action} this record`);
+    }
+  }
+
+  /**
+   * Get table name from API name
+   */
+  private getTableName(apiName: string): string {
+    // Convert CamelCase to snake_case and pluralize
+    const snakeCase = apiName
+      .replace(/([A-Z])/g, '_$1')
+      .toLowerCase()
+      .replace(/^_/, '');
+    
+    // Simple pluralization
+    if (snakeCase.endsWith('y')) {
+      return snakeCase.slice(0, -1) + 'ies';
+    } else if (snakeCase.endsWith('s')) {
+      return snakeCase;
+    } else {
+      return snakeCase + 's';
+    }
+  }
+}

backend/src/rbac/dto/create-record-share.dto.ts

@@ -0,0 +1,19 @@
+import { IsString, IsBoolean, IsOptional, IsDateString } from 'class-validator';
+
+export class CreateRecordShareDto {
+  @IsString()
+  granteeUserId: string;
+
+  @IsBoolean()
+  canRead: boolean;
+
+  @IsBoolean()
+  canEdit: boolean;
+
+  @IsBoolean()
+  canDelete: boolean;
+
+  @IsOptional()
+  @IsDateString()
+  expiresAt?: string;
+}

backend/src/rbac/rbac.module.ts

@@ -1,8 +1,16 @@
 import { Module } from '@nestjs/common';
 import { RbacService } from './rbac.service';
+import { AbilityFactory } from './ability.factory';
+import { AuthorizationService } from './authorization.service';
+import { SetupRolesController } from './setup-roles.controller';
+import { SetupUsersController } from './setup-users.controller';
+import { RecordSharingController } from './record-sharing.controller';
+import { TenantModule } from '../tenant/tenant.module';
 
 @Module({
-  providers: [RbacService],
-  exports: [RbacService],
+  imports: [TenantModule],
+  controllers: [SetupRolesController, SetupUsersController, RecordSharingController],
+  providers: [RbacService, AbilityFactory, AuthorizationService],
+  exports: [RbacService, AbilityFactory, AuthorizationService],
 })
 export class RbacModule {}

backend/src/rbac/record-sharing.controller.ts

@@ -0,0 +1,324 @@
+import {
+  Controller,
+  Get,
+  Post,
+  Delete,
+  Param,
+  Body,
+  UseGuards,
+  ForbiddenException,
+} from '@nestjs/common';
+import { JwtAuthGuard } from '../auth/jwt-auth.guard';
+import { TenantId } from '../tenant/tenant.decorator';
+import { CurrentUser } from '../auth/current-user.decorator';
+import { TenantDatabaseService } from '../tenant/tenant-database.service';
+import { RecordShare } from '../models/record-share.model';
+import { ObjectDefinition } from '../models/object-definition.model';
+import { User } from '../models/user.model';
+import { AuthorizationService } from './authorization.service';
+import { CreateRecordShareDto } from './dto/create-record-share.dto';
+
+@Controller('runtime/objects/:objectApiName/records/:recordId/shares')
+@UseGuards(JwtAuthGuard)
+export class RecordSharingController {
+  constructor(
+    private tenantDbService: TenantDatabaseService,
+    private authService: AuthorizationService,
+  ) {}
+
+  @Get()
+  async getRecordShares(
+    @TenantId() tenantId: string,
+    @Param('objectApiName') objectApiName: string,
+    @Param('recordId') recordId: string,
+    @CurrentUser() currentUser: any,
+  ) {
+    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
+    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
+
+    // Get object definition
+    const objectDef = await ObjectDefinition.query(knex)
+      .findOne({ apiName: objectApiName });
+
+    if (!objectDef) {
+      throw new Error('Object not found');
+    }
+
+    // Get the record to check ownership
+    const tableName = this.getTableName(objectDef.apiName);
+    const record = await knex(tableName)
+      .where({ id: recordId })
+      .first();
+
+    if (!record) {
+      throw new Error('Record not found');
+    }
+
+    // Only owner can view shares
+    if (record.ownerId !== currentUser.userId) {
+      // Check if user has modify all permission
+      const user: any = await User.query(knex)
+        .findById(currentUser.userId)
+        .withGraphFetched('roles.objectPermissions');
+
+      if (!user) {
+        throw new ForbiddenException('User not found');
+      }
+
+      const hasModifyAll = user.roles?.some(role =>
+        role.objectPermissions?.some(
+          perm => perm.objectDefinitionId === objectDef.id && perm.canModifyAll
+        )
+      );
+
+      if (!hasModifyAll) {
+        throw new ForbiddenException('Only the record owner or users with Modify All permission can view shares');
+      }
+    }
+
+    // Get all active shares for this record
+    const shares = await RecordShare.query(knex)
+      .where({ objectDefinitionId: objectDef.id, recordId })
+      .whereNull('revokedAt')
+      .where(builder => {
+        builder.whereNull('expiresAt').orWhere('expiresAt', '>', new Date());
+      })
+      .withGraphFetched('[granteeUser]')
+      .orderBy('createdAt', 'desc');
+
+    return shares;
+  }
+
+  @Post()
+  async createRecordShare(
+    @TenantId() tenantId: string,
+    @Param('objectApiName') objectApiName: string,
+    @Param('recordId') recordId: string,
+    @CurrentUser() currentUser: any,
+    @Body() data: CreateRecordShareDto,
+  ) {
+    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
+    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
+
+    // Get object definition
+    const objectDef = await ObjectDefinition.query(knex)
+      .findOne({ apiName: objectApiName });
+
+    if (!objectDef) {
+      throw new Error('Object not found');
+    }
+
+    // Get the record to check ownership
+    const tableName = this.getTableName(objectDef.apiName);
+    const record = await knex(tableName)
+      .where({ id: recordId })
+      .first();
+
+    if (!record) {
+      throw new Error('Record not found');
+    }
+
+    // Check if user can share - either owner or has modify permissions
+    const canShare = await this.canUserShareRecord(
+      currentUser.userId,
+      record,
+      objectDef,
+      knex,
+    );
+
+    if (!canShare) {
+      throw new ForbiddenException('You do not have permission to share this record');
+    }
+
+    // Cannot share with self
+    if (data.granteeUserId === currentUser.userId) {
+      throw new Error('Cannot share record with yourself');
+    }
+
+    // Check if share already exists
+    const existingShare = await RecordShare.query(knex)
+      .where({
+        objectDefinitionId: objectDef.id,
+        recordId,
+        granteeUserId: data.granteeUserId,
+      })
+      .whereNull('revokedAt')
+      .first();
+
+    if (existingShare) {
+      // Update existing share
+      const updated = await RecordShare.query(knex)
+        .patchAndFetchById(existingShare.id, {
+          accessLevel: {
+            canRead: data.canRead,
+            canEdit: data.canEdit,
+            canDelete: data.canDelete,
+          },
+          // Convert ISO string to MySQL datetime format
+          expiresAt: data.expiresAt 
+            ? knex.raw('?', [new Date(data.expiresAt).toISOString().slice(0, 19).replace('T', ' ')]) 
+            : null,
+        } as any);
+
+      return RecordShare.query(knex)
+        .findById(updated.id)
+        .withGraphFetched('[granteeUser]');
+    }
+
+    // Create new share
+    const share = await RecordShare.query(knex).insertAndFetch({
+      objectDefinitionId: objectDef.id,
+      recordId,
+      granteeUserId: data.granteeUserId,
+      grantedByUserId: currentUser.userId,
+      accessLevel: {
+        canRead: data.canRead,
+        canEdit: data.canEdit,
+        canDelete: data.canDelete,
+      },
+      // Convert ISO string to MySQL datetime format: YYYY-MM-DD HH:MM:SS
+      expiresAt: data.expiresAt 
+        ? knex.raw('?', [new Date(data.expiresAt).toISOString().slice(0, 19).replace('T', ' ')]) 
+        : null,
+    } as any);
+
+    return RecordShare.query(knex)
+      .findById(share.id)
+      .withGraphFetched('[granteeUser]');
+  }
+
+  @Delete(':shareId')
+  async deleteRecordShare(
+    @TenantId() tenantId: string,
+    @Param('objectApiName') objectApiName: string,
+    @Param('recordId') recordId: string,
+    @Param('shareId') shareId: string,
+    @CurrentUser() currentUser: any,
+  ) {
+    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
+    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
+
+    // Get object definition
+    const objectDef = await ObjectDefinition.query(knex)
+      .findOne({ apiName: objectApiName });
+
+    if (!objectDef) {
+      throw new Error('Object not found');
+    }
+
+    // Get the record to check ownership
+    const tableName = this.getTableName(objectDef.apiName);
+    const record = await knex(tableName)
+      .where({ id: recordId })
+      .first();
+
+    if (!record) {
+      throw new Error('Record not found');
+    }
+
+    // Only owner can revoke shares
+    if (record.ownerId !== currentUser.userId) {
+      // Check if user has modify all permission
+      const user: any = await User.query(knex)
+        .findById(currentUser.userId)
+        .withGraphFetched('roles.objectPermissions');
+
+      if (!user) {
+        throw new ForbiddenException('User not found');
+      }
+
+      const hasModifyAll = user.roles?.some(role =>
+        role.objectPermissions?.some(
+          perm => perm.objectDefinitionId === objectDef.id && perm.canModifyAll
+        )
+      );
+
+      if (!hasModifyAll) {
+        throw new ForbiddenException('Only the record owner or users with Modify All permission can revoke shares');
+      }
+    }
+
+    // Revoke the share (soft delete)
+    await RecordShare.query(knex)
+      .patchAndFetchById(shareId, {
+        revokedAt: knex.fn.now() as any,
+      });
+
+    return { success: true };
+  }
+
+  private async canUserShareRecord(
+    userId: string,
+    record: any,
+    objectDef: ObjectDefinition,
+    knex: any,
+  ): Promise<boolean> {
+    // Owner can always share
+    if (record.ownerId === userId) {
+      return true;
+    }
+
+    // Check if user has modify all or edit permissions
+    const user: any = await User.query(knex)
+      .findById(userId)
+      .withGraphFetched('roles.objectPermissions');
+
+    if (!user) {
+      return false;
+    }
+
+    // Check for canModifyAll permission
+    const hasModifyAll = user.roles?.some(role =>
+      role.objectPermissions?.some(
+        perm => perm.objectDefinitionId === objectDef.id && perm.canModifyAll
+      )
+    );
+
+    if (hasModifyAll) {
+      return true;
+    }
+
+    // Check for canEdit permission (user needs edit to share)
+    const hasEdit = user.roles?.some(role =>
+      role.objectPermissions?.some(
+        perm => perm.objectDefinitionId === objectDef.id && perm.canEdit
+      )
+    );
+
+    // If user has edit permission, check if they can actually edit this record
+    // by using the authorization service
+    if (hasEdit) {
+      try {
+        await this.authService.assertCanPerformAction(
+          'update',
+          objectDef,
+          record,
+          user,
+          knex,
+        );
+        return true;
+      } catch {
+        return false;
+      }
+    }
+
+    return false;
+  }
+
+  private getTableName(apiName: string): string {
+    // Convert CamelCase to snake_case and pluralize
+    const snakeCase = apiName
+      .replace(/([A-Z])/g, '_$1')
+      .toLowerCase()
+      .replace(/^_/, '');
+    
+    // Simple pluralization
+    if (snakeCase.endsWith('y')) {
+      return snakeCase.slice(0, -1) + 'ies';
+    } else if (snakeCase.endsWith('s')) {
+      return snakeCase + 'es';
+    } else {
+      return snakeCase + 's';
+    }
+  }
+}

backend/src/rbac/setup-roles.controller.ts

@@ -0,0 +1,141 @@
+import {
+  Controller,
+  Get,
+  Post,
+  Patch,
+  Delete,
+  Param,
+  Body,
+  UseGuards,
+} from '@nestjs/common';
+import { JwtAuthGuard } from '../auth/jwt-auth.guard';
+import { TenantId } from '../tenant/tenant.decorator';
+import { TenantDatabaseService } from '../tenant/tenant-database.service';
+import { Role } from '../models/role.model';
+
+@Controller('setup/roles')
+@UseGuards(JwtAuthGuard)
+export class SetupRolesController {
+  constructor(private tenantDbService: TenantDatabaseService) {}
+
+  @Get()
+  async getRoles(@TenantId() tenantId: string) {
+    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
+    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
+    
+    return await Role.query(knex).select('*').orderBy('name', 'asc');
+  }
+
+  @Get(':id')
+  async getRole(
+    @TenantId() tenantId: string,
+    @Param('id') id: string,
+  ) {
+    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
+    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
+    
+    return await Role.query(knex).findById(id).withGraphFetched('users');
+  }
+
+  @Post()
+  async createRole(
+    @TenantId() tenantId: string,
+    @Body() data: { name: string; description?: string; guardName?: string },
+  ) {
+    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
+    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
+    
+    const role = await Role.query(knex).insert({
+      name: data.name,
+      description: data.description,
+      guardName: data.guardName || 'tenant',
+    });
+    
+    return role;
+  }
+
+  @Patch(':id')
+  async updateRole(
+    @TenantId() tenantId: string,
+    @Param('id') id: string,
+    @Body() data: { name?: string; description?: string; guardName?: string },
+  ) {
+    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
+    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
+    
+    const updateData: any = {};
+    
+    if (data.name) updateData.name = data.name;
+    if (data.description !== undefined) updateData.description = data.description;
+    if (data.guardName) updateData.guardName = data.guardName;
+    
+    const role = await Role.query(knex).patchAndFetchById(id, updateData);
+    return role;
+  }
+
+  @Delete(':id')
+  async deleteRole(
+    @TenantId() tenantId: string,
+    @Param('id') id: string,
+  ) {
+    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
+    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
+    
+    // Delete role user assignments first
+    await knex('user_roles').where({ roleId: id }).delete();
+    
+    // Delete role permissions
+    await knex('role_permissions').where({ roleId: id }).delete();
+    await knex('role_object_permissions').where({ roleId: id }).delete();
+    
+    // Delete the role
+    await Role.query(knex).deleteById(id);
+    
+    return { success: true };
+  }
+
+  @Post(':roleId/users')
+  async addUserToRole(
+    @TenantId() tenantId: string,
+    @Param('roleId') roleId: string,
+    @Body() data: { userId: string },
+  ) {
+    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
+    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
+    
+    // Check if assignment already exists
+    const existing = await knex('user_roles')
+      .where({ userId: data.userId, roleId })
+      .first();
+    
+    if (existing) {
+      return { success: true, message: 'User already assigned' };
+    }
+    
+    await knex('user_roles').insert({
+      id: knex.raw('(UUID())'),
+      userId: data.userId,
+      roleId,
+      created_at: knex.fn.now(),
+      updated_at: knex.fn.now(),
+    });
+    
+    return { success: true };
+  }
+
+  @Delete(':roleId/users/:userId')
+  async removeUserFromRole(
+    @TenantId() tenantId: string,
+    @Param('roleId') roleId: string,
+    @Param('userId') userId: string,
+  ) {
+    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
+    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
+    
+    await knex('user_roles')
+      .where({ userId, roleId })
+      .delete();
+    
+    return { success: true };
+  }
+}

backend/src/rbac/setup-users.controller.ts

@@ -0,0 +1,146 @@
+import {
+  Controller,
+  Get,
+  Post,
+  Patch,
+  Delete,
+  Param,
+  Body,
+  UseGuards,
+} from '@nestjs/common';
+import { JwtAuthGuard } from '../auth/jwt-auth.guard';
+import { TenantId } from '../tenant/tenant.decorator';
+import { TenantDatabaseService } from '../tenant/tenant-database.service';
+import { User } from '../models/user.model';
+import * as bcrypt from 'bcrypt';
+
+@Controller('setup/users')
+@UseGuards(JwtAuthGuard)
+export class SetupUsersController {
+  constructor(private tenantDbService: TenantDatabaseService) {}
+
+  @Get()
+  async getUsers(@TenantId() tenantId: string) {
+    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
+    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
+    return await User.query(knex).withGraphFetched('roles');
+  }
+
+  @Get(':id')
+  async getUser(
+    @TenantId() tenantId: string,
+    @Param('id') id: string,
+  ) {
+    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
+    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
+    return await User.query(knex).findById(id).withGraphFetched('roles');
+  }
+
+  @Post()
+  async createUser(
+    @TenantId() tenantId: string,
+    @Body() data: { email: string; password: string; firstName?: string; lastName?: string },
+  ) {
+    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
+    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
+    
+    // Hash password
+    const hashedPassword = await bcrypt.hash(data.password, 10);
+    
+    const user = await User.query(knex).insert({
+      email: data.email,
+      password: hashedPassword,
+      firstName: data.firstName,
+      lastName: data.lastName,
+      isActive: true,
+    });
+    
+    return user;
+  }
+
+  @Patch(':id')
+  async updateUser(
+    @TenantId() tenantId: string,
+    @Param('id') id: string,
+    @Body() data: { email?: string; password?: string; firstName?: string; lastName?: string },
+  ) {
+    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
+    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
+    
+    const updateData: any = {};
+    
+    if (data.email) updateData.email = data.email;
+    if (data.firstName !== undefined) updateData.firstName = data.firstName;
+    if (data.lastName !== undefined) updateData.lastName = data.lastName;
+    
+    // Hash password if provided
+    if (data.password) {
+      updateData.password = await bcrypt.hash(data.password, 10);
+    }
+    
+    const user = await User.query(knex).patchAndFetchById(id, updateData);
+    return user;
+  }
+
+  @Delete(':id')
+  async deleteUser(
+    @TenantId() tenantId: string,
+    @Param('id') id: string,
+  ) {
+    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
+    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
+    
+    // Delete user role assignments first
+    await knex('user_roles').where({ userId: id }).delete();
+    
+    // Delete the user
+    await User.query(knex).deleteById(id);
+    
+    return { success: true };
+  }
+
+  @Post(':userId/roles')
+  async addRoleToUser(
+    @TenantId() tenantId: string,
+    @Param('userId') userId: string,
+    @Body() data: { roleId: string },
+  ) {
+    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
+    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
+    
+    // Check if assignment already exists
+    const existing = await knex('user_roles')
+      .where({ userId, roleId: data.roleId })
+      .first();
+    
+    if (existing) {
+      return { success: true, message: 'Role already assigned' };
+    }
+    
+    await knex('user_roles').insert({
+      id: knex.raw('(UUID())'),
+      userId,
+      roleId: data.roleId,
+      created_at: knex.fn.now(),
+      updated_at: knex.fn.now(),
+    });
+    
+    return { success: true };
+  }
+
+  @Delete(':userId/roles/:roleId')
+  async removeRoleFromUser(
+    @TenantId() tenantId: string,
+    @Param('userId') userId: string,
+    @Param('roleId') roleId: string,
+  ) {
+    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
+    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
+    
+    await knex('user_roles')
+      .where({ userId, roleId })
+      .delete();
+    
+    return { success: true };
+  }
+}

backend/src/tenant/tenant-database.service.ts

@@ -242,4 +242,26 @@ export class TenantDatabaseService {
     decrypted += decipher.final('utf8');
     return decrypted;
   }
+
+  /**
+   * Encrypt integrations config JSON object
+   * @param config - Plain object containing integration credentials
+   * @returns Encrypted JSON string
+   */
+  encryptIntegrationsConfig(config: any): string {
+    if (!config) return null;
+    const jsonString = JSON.stringify(config);
+    return this.encryptPassword(jsonString);
+  }
+
+  /**
+   * Decrypt integrations config JSON string
+   * @param encryptedConfig - Encrypted JSON string
+   * @returns Plain object with integration credentials
+   */
+  decryptIntegrationsConfig(encryptedConfig: string): any {
+    if (!encryptedConfig) return null;
+    const decrypted = this.decryptPassword(encryptedConfig);
+    return JSON.parse(decrypted);
+  }
 }

backend/src/tenant/tenant-provisioning.service.ts

@@ -176,7 +176,7 @@ export class TenantProvisioningService {
    * Seed default data for new tenant
    */
   private async seedDefaultData(tenantId: string) {
-    const tenantKnex = await this.tenantDbService.getTenantKnex(tenantId);
+    const tenantKnex = await this.tenantDbService.getTenantKnexById(tenantId);
 
     try {
       // Create default roles

backend/src/tenant/tenant.controller.ts

@@ -0,0 +1,102 @@
+import {
+  Controller,
+  Get,
+  Put,
+  Body,
+  UseGuards,
+  Req,
+} from '@nestjs/common';
+import { JwtAuthGuard } from '../auth/jwt-auth.guard';
+import { TenantDatabaseService } from './tenant-database.service';
+import { getCentralPrisma } from '../prisma/central-prisma.service';
+import { TenantId } from './tenant.decorator';
+
+@Controller('tenant')
+@UseGuards(JwtAuthGuard)
+export class TenantController {
+  constructor(private readonly tenantDbService: TenantDatabaseService) {}
+
+  /**
+   * Get integrations configuration for the current tenant
+   */
+  @Get('integrations')
+  async getIntegrationsConfig(@TenantId() tenantId: string) {
+    const centralPrisma = getCentralPrisma();
+    
+    const tenant = await centralPrisma.tenant.findUnique({
+      where: { id: tenantId },
+      select: { integrationsConfig: true },
+    });
+
+    if (!tenant || !tenant.integrationsConfig) {
+      return { data: null };
+    }
+
+    // Decrypt the config
+    const config = this.tenantDbService.decryptIntegrationsConfig(
+      tenant.integrationsConfig as any,
+    );
+
+    // Return config with sensitive fields masked
+    const maskedConfig = this.maskSensitiveFields(config);
+
+    return { data: maskedConfig };
+  }
+
+  /**
+   * Update integrations configuration for the current tenant
+   */
+  @Put('integrations')
+  async updateIntegrationsConfig(
+    @TenantId() tenantId: string,
+    @Body() body: { integrationsConfig: any },
+  ) {
+    const { integrationsConfig } = body;
+
+    // Encrypt the config
+    const encryptedConfig = this.tenantDbService.encryptIntegrationsConfig(
+      integrationsConfig,
+    );
+
+    // Update in database
+    const centralPrisma = getCentralPrisma();
+    await centralPrisma.tenant.update({
+      where: { id: tenantId },
+      data: {
+        integrationsConfig: encryptedConfig as any,
+      },
+    });
+
+    return {
+      success: true,
+      message: 'Integrations configuration updated successfully',
+    };
+  }
+
+  /**
+   * Mask sensitive fields for API responses
+   */
+  private maskSensitiveFields(config: any): any {
+    if (!config) return null;
+
+    const masked = { ...config };
+
+    // Mask Twilio credentials
+    if (masked.twilio) {
+      masked.twilio = {
+        ...masked.twilio,
+        authToken: masked.twilio.authToken ? '••••••••' : '',
+      };
+    }
+
+    // Mask OpenAI credentials
+    if (masked.openai) {
+      masked.openai = {
+        ...masked.openai,
+        apiKey: masked.openai.apiKey ? '••••••••' : '',
+      };
+    }
+
+    return masked;
+  }
+}

backend/src/tenant/tenant.module.ts

@@ -4,11 +4,12 @@ import { TenantDatabaseService } from './tenant-database.service';
 import { TenantProvisioningService } from './tenant-provisioning.service';
 import { TenantProvisioningController } from './tenant-provisioning.controller';
 import { CentralAdminController } from './central-admin.controller';
+import { TenantController } from './tenant.controller';
 import { PrismaModule } from '../prisma/prisma.module';
 
 @Module({
   imports: [PrismaModule],
-  controllers: [TenantProvisioningController, CentralAdminController],
+  controllers: [TenantProvisioningController, CentralAdminController, TenantController],
   providers: [
     TenantDatabaseService,
     TenantProvisioningService,

backend/src/voice/dto/call-event.dto.ts

@@ -0,0 +1,25 @@
+export interface CallEventDto {
+  callSid: string;
+  direction: 'inbound' | 'outbound';
+  fromNumber: string;
+  toNumber: string;
+  status: string;
+}
+
+export interface DtmfEventDto {
+  callSid: string;
+  digit: string;
+}
+
+export interface TranscriptEventDto {
+  callSid: string;
+  transcript: string;
+  isFinal: boolean;
+}
+
+export interface AiSuggestionDto {
+  callSid: string;
+  suggestion: string;
+  type: 'response' | 'action' | 'insight';
+  data?: any;
+}

backend/src/voice/dto/initiate-call.dto.ts

@@ -0,0 +1,10 @@
+import { IsString, IsNotEmpty, Matches } from 'class-validator';
+
+export class InitiateCallDto {
+  @IsString()
+  @IsNotEmpty()
+  @Matches(/^\+?[1-9]\d{1,14}$/, {
+    message: 'Invalid phone number format (use E.164 format)',
+  })
+  toNumber: string;
+}

backend/src/voice/interfaces/integration-config.interface.ts

@@ -0,0 +1,19 @@
+export interface TwilioConfig {
+  accountSid: string;
+  authToken: string;
+  phoneNumber: string;
+  apiKeySid?: string;
+  apiKeySecret?: string;
+}
+
+export interface OpenAIConfig {
+  apiKey: string;
+  assistantId?: string;
+  model?: string;
+  voice?: string;
+}
+
+export interface IntegrationsConfig {
+  twilio?: TwilioConfig;
+  openai?: OpenAIConfig;
+}

backend/src/voice/voice.controller.ts

@@ -0,0 +1,195 @@
+import {
+  Controller,
+  Post,
+  Get,
+  Body,
+  Req,
+  Res,
+  UseGuards,
+  Logger,
+  Query,
+} from '@nestjs/common';
+import { FastifyRequest, FastifyReply } from 'fastify';
+import { JwtAuthGuard } from '../auth/jwt-auth.guard';
+import { VoiceService } from './voice.service';
+import { VoiceGateway } from './voice.gateway';
+import { InitiateCallDto } from './dto/initiate-call.dto';
+import { TenantId } from '../tenant/tenant.decorator';
+
+@Controller('voice')
+export class VoiceController {
+  private readonly logger = new Logger(VoiceController.name);
+
+  constructor(
+    private readonly voiceService: VoiceService,
+    private readonly voiceGateway: VoiceGateway,
+  ) {}
+
+  /**
+   * Initiate outbound call via REST
+   */
+  @Post('call')
+  @UseGuards(JwtAuthGuard)
+  async initiateCall(
+    @Body() body: InitiateCallDto,
+    @Req() req: any,
+    @TenantId() tenantId: string,
+  ) {
+    const userId = req.user?.userId || req.user?.sub;
+
+    const result = await this.voiceService.initiateCall({
+      tenantId,
+      userId,
+      toNumber: body.toNumber,
+    });
+
+    return {
+      success: true,
+      data: result,
+    };
+  }
+
+  /**
+   * Get call history
+   */
+  @Get('calls')
+  @UseGuards(JwtAuthGuard)
+  async getCallHistory(
+    @Req() req: any,
+    @TenantId() tenantId: string,
+    @Query('limit') limit?: string,
+  ) {
+    const userId = req.user?.userId || req.user?.sub;
+    const calls = await this.voiceService.getCallHistory(
+      tenantId,
+      userId,
+      limit ? parseInt(limit) : 50,
+    );
+
+    return {
+      success: true,
+      data: calls,
+    };
+  }
+
+  /**
+   * TwiML for outbound calls
+   */
+  @Post('twiml/outbound')
+  async outboundTwiml(@Req() req: FastifyRequest, @Res() res: FastifyReply) {
+    const twiml = `<?xml version="1.0" encoding="UTF-8"?>
+<Response>
+  <Start>
+    <Stream url="wss://${req.headers.host}/api/voice/stream" />
+  </Start>
+  <Say>Connecting your call</Say>
+  <Dial>
+    <Number>${(req.body as any).To}</Number>
+  </Dial>
+</Response>`;
+
+    res.type('text/xml').send(twiml);
+  }
+
+  /**
+   * TwiML for inbound calls
+   */
+  @Post('twiml/inbound')
+  async inboundTwiml(@Req() req: FastifyRequest, @Res() res: FastifyReply) {
+    const body = req.body as any;
+    const callSid = body.CallSid;
+    const fromNumber = body.From;
+    const toNumber = body.To;
+
+    this.logger.log(`Incoming call: ${callSid} from ${fromNumber} to ${toNumber}`);
+
+    // TODO: Determine tenant from phone number mapping
+    // TODO: Find available user to route call to
+    // For now, return a simple TwiML response
+
+    const twiml = `<?xml version="1.0" encoding="UTF-8"?>
+<Response>
+  <Start>
+    <Stream url="wss://${req.headers.host}/api/voice/stream" />
+  </Start>
+  <Say>Please wait while we connect you to an agent</Say>
+  <Dial>
+    <Queue>support</Queue>
+  </Dial>
+</Response>`;
+
+    res.type('text/xml').send(twiml);
+  }
+
+  /**
+   * Twilio status webhook
+   */
+  @Post('webhook/status')
+  async statusWebhook(@Req() req: FastifyRequest) {
+    const body = req.body as any;
+    const callSid = body.CallSid;
+    const status = body.CallStatus;
+    const duration = body.CallDuration ? parseInt(body.CallDuration) : undefined;
+
+    this.logger.log(`Call status update: ${callSid} -> ${status}`);
+
+    // TODO: Extract tenant ID from call record
+    // For now, we'll need to lookup the call to get tenant ID
+    // This is a limitation - we should store tenantId in call metadata
+
+    try {
+      // Update call status
+      // await this.voiceService.updateCallStatus({
+      //   callSid,
+      //   tenantId: 'LOOKUP_NEEDED',
+      //   status,
+      //   duration,
+      // });
+
+      // Notify user via WebSocket
+      // await this.voiceGateway.notifyCallUpdate(userId, {
+      //   callSid,
+      //   status,
+      //   duration,
+      // });
+    } catch (error) {
+      this.logger.error('Failed to process status webhook', error);
+    }
+
+    return { success: true };
+  }
+
+  /**
+   * Twilio recording webhook
+   */
+  @Post('webhook/recording')
+  async recordingWebhook(@Req() req: FastifyRequest) {
+    const body = req.body as any;
+    const callSid = body.CallSid;
+    const recordingUrl = body.RecordingUrl;
+
+    this.logger.log(`Recording available for call ${callSid}: ${recordingUrl}`);
+
+    // TODO: Update call record with recording URL
+    // TODO: Trigger transcription if needed
+
+    return { success: true };
+  }
+
+  /**
+   * WebSocket endpoint for Twilio Media Streams
+   */
+  @Post('stream')
+  async mediaStream(@Req() req: FastifyRequest, @Res() res: FastifyReply) {
+    // Twilio Media Streams use WebSocket protocol
+    // This would need to be handled by the WebSocket server
+    // In Fastify, we need to upgrade the connection
+
+    this.logger.log('Media stream connection requested');
+
+    // TODO: Implement WebSocket upgrade for media streams
+    // This will handle bidirectional audio streaming between Twilio and OpenAI
+
+    res.send({ message: 'WebSocket upgrade required' });
+  }
+}

backend/src/voice/voice.gateway.ts

@@ -0,0 +1,273 @@
+import {
+  WebSocketGateway,
+  WebSocketServer,
+  SubscribeMessage,
+  OnGatewayConnection,
+  OnGatewayDisconnect,
+  ConnectedSocket,
+  MessageBody,
+} from '@nestjs/websockets';
+import { Server, Socket } from 'socket.io';
+import { Logger, UseGuards } from '@nestjs/common';
+import { JwtService } from '@nestjs/jwt';
+import { VoiceService } from './voice.service';
+import { TenantDatabaseService } from '../tenant/tenant-database.service';
+
+interface AuthenticatedSocket extends Socket {
+  tenantId?: string;
+  userId?: string;
+  tenantSlug?: string;
+}
+
+@WebSocketGateway({
+  namespace: 'voice',
+  cors: {
+    origin: true,
+    credentials: true,
+  },
+})
+export class VoiceGateway
+  implements OnGatewayConnection, OnGatewayDisconnect
+{
+  @WebSocketServer()
+  server: Server;
+
+  private readonly logger = new Logger(VoiceGateway.name);
+  private connectedUsers: Map<string, AuthenticatedSocket> = new Map();
+  private activeCallsByUser: Map<string, string> = new Map(); // userId -> callSid
+
+  constructor(
+    private readonly jwtService: JwtService,
+    private readonly voiceService: VoiceService,
+    private readonly tenantDbService: TenantDatabaseService,
+  ) {}
+
+  async handleConnection(client: AuthenticatedSocket) {
+    try {
+      // Extract token from handshake auth
+      const token =
+        client.handshake.auth.token || client.handshake.headers.authorization?.split(' ')[1];
+
+      if (!token) {
+        this.logger.warn('Client connection rejected: No token provided');
+        client.disconnect();
+        return;
+      }
+
+      // Verify JWT token
+      const payload = await this.jwtService.verifyAsync(token);
+      client.tenantId = payload.tenantId;
+      client.userId = payload.sub;
+      client.tenantSlug = payload.tenantSlug;
+
+      this.connectedUsers.set(client.userId, client);
+      this.logger.log(
+        `Client connected: ${client.id} (User: ${client.userId}, Tenant: ${client.tenantSlug})`,
+      );
+
+      // Send current call state if any active call
+      const activeCallSid = this.activeCallsByUser.get(client.userId);
+      if (activeCallSid) {
+        const callState = await this.voiceService.getCallState(
+          activeCallSid,
+          client.tenantId,
+        );
+        client.emit('call:state', callState);
+      }
+    } catch (error) {
+      this.logger.error('Authentication failed', error);
+      client.disconnect();
+    }
+  }
+
+  handleDisconnect(client: AuthenticatedSocket) {
+    if (client.userId) {
+      this.connectedUsers.delete(client.userId);
+      this.logger.log(`Client disconnected: ${client.id} (User: ${client.userId})`);
+    }
+  }
+
+  /**
+   * Initiate outbound call
+   */
+  @SubscribeMessage('call:initiate')
+  async handleInitiateCall(
+    @ConnectedSocket() client: AuthenticatedSocket,
+    @MessageBody() data: { toNumber: string },
+  ) {
+    try {
+      this.logger.log(`Initiating call from user ${client.userId} to ${data.toNumber}`);
+
+      const result = await this.voiceService.initiateCall({
+        tenantId: client.tenantId,
+        userId: client.userId,
+        toNumber: data.toNumber,
+      });
+
+      this.activeCallsByUser.set(client.userId, result.callSid);
+
+      client.emit('call:initiated', {
+        callSid: result.callSid,
+        toNumber: data.toNumber,
+        status: 'queued',
+      });
+
+      return { success: true, callSid: result.callSid };
+    } catch (error) {
+      this.logger.error('Failed to initiate call', error);
+      client.emit('call:error', {
+        message: error.message || 'Failed to initiate call',
+      });
+      return { success: false, error: error.message };
+    }
+  }
+
+  /**
+   * Accept incoming call
+   */
+  @SubscribeMessage('call:accept')
+  async handleAcceptCall(
+    @ConnectedSocket() client: AuthenticatedSocket,
+    @MessageBody() data: { callSid: string },
+  ) {
+    try {
+      this.logger.log(`User ${client.userId} accepting call ${data.callSid}`);
+
+      await this.voiceService.acceptCall({
+        callSid: data.callSid,
+        tenantId: client.tenantId,
+        userId: client.userId,
+      });
+
+      this.activeCallsByUser.set(client.userId, data.callSid);
+
+      client.emit('call:accepted', { callSid: data.callSid });
+
+      return { success: true };
+    } catch (error) {
+      this.logger.error('Failed to accept call', error);
+      return { success: false, error: error.message };
+    }
+  }
+
+  /**
+   * Reject incoming call
+   */
+  @SubscribeMessage('call:reject')
+  async handleRejectCall(
+    @ConnectedSocket() client: AuthenticatedSocket,
+    @MessageBody() data: { callSid: string },
+  ) {
+    try {
+      this.logger.log(`User ${client.userId} rejecting call ${data.callSid}`);
+
+      await this.voiceService.rejectCall(data.callSid, client.tenantId);
+
+      client.emit('call:rejected', { callSid: data.callSid });
+
+      return { success: true };
+    } catch (error) {
+      this.logger.error('Failed to reject call', error);
+      return { success: false, error: error.message };
+    }
+  }
+
+  /**
+   * End active call
+   */
+  @SubscribeMessage('call:end')
+  async handleEndCall(
+    @ConnectedSocket() client: AuthenticatedSocket,
+    @MessageBody() data: { callSid: string },
+  ) {
+    try {
+      this.logger.log(`User ${client.userId} ending call ${data.callSid}`);
+
+      await this.voiceService.endCall(data.callSid, client.tenantId);
+
+      this.activeCallsByUser.delete(client.userId);
+
+      client.emit('call:ended', { callSid: data.callSid });
+
+      return { success: true };
+    } catch (error) {
+      this.logger.error('Failed to end call', error);
+      return { success: false, error: error.message };
+    }
+  }
+
+  /**
+   * Send DTMF tones
+   */
+  @SubscribeMessage('call:dtmf')
+  async handleDtmf(
+    @ConnectedSocket() client: AuthenticatedSocket,
+    @MessageBody() data: { callSid: string; digit: string },
+  ) {
+    try {
+      await this.voiceService.sendDtmf(
+        data.callSid,
+        data.digit,
+        client.tenantId,
+      );
+
+      return { success: true };
+    } catch (error) {
+      this.logger.error('Failed to send DTMF', error);
+      return { success: false, error: error.message };
+    }
+  }
+
+  /**
+   * Emit incoming call notification to specific user
+   */
+  async notifyIncomingCall(userId: string, callData: any) {
+    const socket = this.connectedUsers.get(userId);
+    if (socket) {
+      socket.emit('call:incoming', callData);
+      this.logger.log(`Notified user ${userId} of incoming call`);
+    } else {
+      this.logger.warn(`User ${userId} not connected to receive call notification`);
+    }
+  }
+
+  /**
+   * Emit call status update to user
+   */
+  async notifyCallUpdate(userId: string, callData: any) {
+    const socket = this.connectedUsers.get(userId);
+    if (socket) {
+      socket.emit('call:update', callData);
+    }
+  }
+
+  /**
+   * Emit AI transcript to user
+   */
+  async notifyAiTranscript(userId: string, data: { callSid: string; transcript: string; isFinal: boolean }) {
+    const socket = this.connectedUsers.get(userId);
+    if (socket) {
+      socket.emit('ai:transcript', data);
+    }
+  }
+
+  /**
+   * Emit AI suggestion to user
+   */
+  async notifyAiSuggestion(userId: string, data: any) {
+    const socket = this.connectedUsers.get(userId);
+    if (socket) {
+      socket.emit('ai:suggestion', data);
+    }
+  }
+
+  /**
+   * Emit AI action result to user
+   */
+  async notifyAiAction(userId: string, data: any) {
+    const socket = this.connectedUsers.get(userId);
+    if (socket) {
+      socket.emit('ai:action', data);
+    }
+  }
+}

backend/src/voice/voice.module.ts

@@ -0,0 +1,22 @@
+import { Module } from '@nestjs/common';
+import { JwtModule } from '@nestjs/jwt';
+import { VoiceGateway } from './voice.gateway';
+import { VoiceService } from './voice.service';
+import { VoiceController } from './voice.controller';
+import { TenantModule } from '../tenant/tenant.module';
+import { AuthModule } from '../auth/auth.module';
+
+@Module({
+  imports: [
+    TenantModule,
+    AuthModule,
+    JwtModule.register({
+      secret: process.env.JWT_SECRET || 'your-jwt-secret',
+      signOptions: { expiresIn: process.env.JWT_EXPIRES_IN || '24h' },
+    }),
+  ],
+  providers: [VoiceGateway, VoiceService],
+  controllers: [VoiceController],
+  exports: [VoiceService],
+})
+export class VoiceModule {}

backend/src/voice/voice.service.ts

@@ -0,0 +1,575 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { TenantDatabaseService } from '../tenant/tenant-database.service';
+import { getCentralPrisma } from '../prisma/central-prisma.service';
+import { IntegrationsConfig, TwilioConfig, OpenAIConfig } from './interfaces/integration-config.interface';
+import * as Twilio from 'twilio';
+import { WebSocket } from 'ws';
+import { v4 as uuidv4 } from 'uuid';
+
+@Injectable()
+export class VoiceService {
+  private readonly logger = new Logger(VoiceService.name);
+  private twilioClients: Map<string, Twilio.Twilio> = new Map();
+  private openaiConnections: Map<string, WebSocket> = new Map(); // callSid -> WebSocket
+  private callStates: Map<string, any> = new Map(); // callSid -> call state
+
+  constructor(
+    private readonly tenantDbService: TenantDatabaseService,
+  ) {}
+
+  /**
+   * Get Twilio client for a tenant
+   */
+  private async getTwilioClient(tenantId: string): Promise<{ client: Twilio.Twilio; config: TwilioConfig }> {
+    // Check cache first
+    if (this.twilioClients.has(tenantId)) {
+      const centralPrisma = getCentralPrisma();
+      const tenant = await centralPrisma.tenant.findUnique({
+        where: { id: tenantId },
+        select: { integrationsConfig: true },
+      });
+
+      const config = this.getIntegrationConfig(tenant?.integrationsConfig as any);
+      return { client: this.twilioClients.get(tenantId), config: config.twilio };
+    }
+
+    // Fetch tenant integrations config
+    const centralPrisma = getCentralPrisma();
+    const tenant = await centralPrisma.tenant.findUnique({
+      where: { id: tenantId },
+      select: { integrationsConfig: true },
+    });
+
+    if (!tenant?.integrationsConfig) {
+      throw new Error('Tenant integrations config not found');
+    }
+
+    const config = this.getIntegrationConfig(tenant.integrationsConfig as any);
+
+    if (!config.twilio?.accountSid || !config.twilio?.authToken) {
+      throw new Error('Twilio credentials not configured for tenant');
+    }
+
+    const client = Twilio.default(config.twilio.accountSid, config.twilio.authToken);
+    this.twilioClients.set(tenantId, client);
+
+    return { client, config: config.twilio };
+  }
+
+  /**
+   * Decrypt and parse integrations config
+   */
+  private getIntegrationConfig(encryptedConfig: any): IntegrationsConfig {
+    if (!encryptedConfig) {
+      return {};
+    }
+
+    // If it's already decrypted (object), return it
+    if (typeof encryptedConfig === 'object' && encryptedConfig.twilio) {
+      return encryptedConfig;
+    }
+
+    // If it's encrypted (string), decrypt it
+    if (typeof encryptedConfig === 'string') {
+      return this.tenantDbService.decryptIntegrationsConfig(encryptedConfig);
+    }
+
+    return {};
+  }
+
+  /**
+   * Initiate outbound call
+   */
+  async initiateCall(params: {
+    tenantId: string;
+    userId: string;
+    toNumber: string;
+  }) {
+    const { tenantId, userId, toNumber } = params;
+
+    try {
+      const { client, config } = await this.getTwilioClient(tenantId);
+
+      // Create call record in database
+      const tenantKnex = await this.tenantDbService.getTenantKnexById(tenantId);
+      const callId = uuidv4();
+
+      // Generate TwiML URL for call flow
+      const twimlUrl = `${process.env.BACKEND_URL || 'http://localhost:3000'}/api/voice/twiml/outbound`;
+
+      // Initiate call via Twilio
+      const call = await client.calls.create({
+        to: toNumber,
+        from: config.phoneNumber,
+        url: twimlUrl,
+        statusCallback: `${process.env.BACKEND_URL || 'http://localhost:3000'}/api/voice/webhook/status`,
+        statusCallbackEvent: ['initiated', 'ringing', 'answered', 'completed'],
+        statusCallbackMethod: 'POST',
+        record: true,
+        recordingStatusCallback: `${process.env.BACKEND_URL || 'http://localhost:3000'}/api/voice/webhook/recording`,
+      });
+
+      // Store call in database
+      await tenantKnex('calls').insert({
+        id: callId,
+        call_sid: call.sid,
+        direction: 'outbound',
+        from_number: config.phoneNumber,
+        to_number: toNumber,
+        status: 'queued',
+        user_id: userId,
+        created_at: tenantKnex.fn.now(),
+        updated_at: tenantKnex.fn.now(),
+      });
+
+      // Store call state in memory
+      this.callStates.set(call.sid, {
+        callId,
+        callSid: call.sid,
+        tenantId,
+        userId,
+        direction: 'outbound',
+        status: 'queued',
+      });
+
+      this.logger.log(`Outbound call initiated: ${call.sid}`);
+
+      return {
+        callId,
+        callSid: call.sid,
+        status: 'queued',
+      };
+    } catch (error) {
+      this.logger.error('Failed to initiate call', error);
+      throw error;
+    }
+  }
+
+  /**
+   * Accept incoming call
+   */
+  async acceptCall(params: {
+    callSid: string;
+    tenantId: string;
+    userId: string;
+  }) {
+    const { callSid, tenantId, userId } = params;
+
+    try {
+      // Note: Twilio doesn't support updating call to 'in-progress' via API
+      // Call status is managed by TwiML and call flow
+      // We'll update our database status instead
+
+      // Update database
+      const tenantKnex = await this.tenantDbService.getTenantKnexById(tenantId);
+      await tenantKnex('calls')
+        .where({ call_sid: callSid })
+        .update({
+          status: 'in-progress',
+          user_id: userId,
+          started_at: tenantKnex.fn.now(),
+          updated_at: tenantKnex.fn.now(),
+        });
+
+      // Update state
+      const state = this.callStates.get(callSid) || {};
+      this.callStates.set(callSid, {
+        ...state,
+        status: 'in-progress',
+        userId,
+      });
+
+      this.logger.log(`Call accepted: ${callSid} by user ${userId}`);
+    } catch (error) {
+      this.logger.error('Failed to accept call', error);
+      throw error;
+    }
+  }
+
+  /**
+   * Reject incoming call
+   */
+  async rejectCall(callSid: string, tenantId: string) {
+    try {
+      const { client } = await this.getTwilioClient(tenantId);
+
+      // End the call
+      await client.calls(callSid).update({
+        status: 'completed',
+      });
+
+      // Update database
+      const tenantKnex = await this.tenantDbService.getTenantKnexById(tenantId);
+      await tenantKnex('calls')
+        .where({ call_sid: callSid })
+        .update({
+          status: 'canceled',
+          updated_at: tenantKnex.fn.now(),
+        });
+
+      // Clean up state
+      this.callStates.delete(callSid);
+
+      this.logger.log(`Call rejected: ${callSid}`);
+    } catch (error) {
+      this.logger.error('Failed to reject call', error);
+      throw error;
+    }
+  }
+
+  /**
+   * End active call
+   */
+  async endCall(callSid: string, tenantId: string) {
+    try {
+      const { client } = await this.getTwilioClient(tenantId);
+
+      // End the call
+      await client.calls(callSid).update({
+        status: 'completed',
+      });
+
+      // Clean up OpenAI connection if exists
+      const openaiWs = this.openaiConnections.get(callSid);
+      if (openaiWs) {
+        openaiWs.close();
+        this.openaiConnections.delete(callSid);
+      }
+
+      // Update database
+      const tenantKnex = await this.tenantDbService.getTenantKnexById(tenantId);
+      await tenantKnex('calls')
+        .where({ call_sid: callSid })
+        .update({
+          status: 'completed',
+          ended_at: tenantKnex.fn.now(),
+          updated_at: tenantKnex.fn.now(),
+        });
+
+      // Clean up state
+      this.callStates.delete(callSid);
+
+      this.logger.log(`Call ended: ${callSid}`);
+    } catch (error) {
+      this.logger.error('Failed to end call', error);
+      throw error;
+    }
+  }
+
+  /**
+   * Send DTMF tones
+   */
+  async sendDtmf(callSid: string, digit: string, tenantId: string) {
+    try {
+      const { client } = await this.getTwilioClient(tenantId);
+
+      // Twilio doesn't support sending DTMF directly via API
+      // This would need to be handled via TwiML <Play> of DTMF tones
+      this.logger.log(`DTMF requested for call ${callSid}: ${digit}`);
+
+      // TODO: Implement DTMF sending via TwiML update
+    } catch (error) {
+      this.logger.error('Failed to send DTMF', error);
+      throw error;
+    }
+  }
+
+  /**
+   * Get call state
+   */
+  async getCallState(callSid: string, tenantId: string) {
+    // Try memory first
+    if (this.callStates.has(callSid)) {
+      return this.callStates.get(callSid);
+    }
+
+    // Fallback to database
+    const tenantKnex = await this.tenantDbService.getTenantKnexById(tenantId);
+    const call = await tenantKnex('calls')
+      .where({ call_sid: callSid })
+      .first();
+
+    return call || null;
+  }
+
+  /**
+   * Update call status from webhook
+   */
+  async updateCallStatus(params: {
+    callSid: string;
+    tenantId: string;
+    status: string;
+    duration?: number;
+    recordingUrl?: string;
+  }) {
+    const { callSid, tenantId, status, duration, recordingUrl } = params;
+
+    try {
+      const tenantKnex = await this.tenantDbService.getTenantKnexById(tenantId);
+
+      const updateData: any = {
+        status,
+        updated_at: tenantKnex.fn.now(),
+      };
+
+      if (duration !== undefined) {
+        updateData.duration_seconds = duration;
+      }
+
+      if (recordingUrl) {
+        updateData.recording_url = recordingUrl;
+      }
+
+      if (status === 'completed') {
+        updateData.ended_at = tenantKnex.fn.now();
+      }
+
+      await tenantKnex('calls')
+        .where({ call_sid: callSid })
+        .update(updateData);
+
+      // Update state
+      const state = this.callStates.get(callSid);
+      if (state) {
+        this.callStates.set(callSid, { ...state, status });
+      }
+
+      this.logger.log(`Call status updated: ${callSid} -> ${status}`);
+    } catch (error) {
+      this.logger.error('Failed to update call status', error);
+      throw error;
+    }
+  }
+
+  /**
+   * Initialize OpenAI Realtime connection for call
+   */
+  async initializeOpenAIRealtime(params: {
+    callSid: string;
+    tenantId: string;
+    userId: string;
+  }) {
+    const { callSid, tenantId, userId } = params;
+
+    try {
+      // Get OpenAI config
+      const centralPrisma = getCentralPrisma();
+      const tenant = await centralPrisma.tenant.findUnique({
+        where: { id: tenantId },
+        select: { integrationsConfig: true },
+      });
+
+      const config = this.getIntegrationConfig(tenant?.integrationsConfig as any);
+
+      if (!config.openai?.apiKey) {
+        this.logger.warn('OpenAI not configured for tenant, skipping AI features');
+        return;
+      }
+
+      // Connect to OpenAI Realtime API
+      const ws = new WebSocket('wss://api.openai.com/v1/realtime', {
+        headers: {
+          'Authorization': `Bearer ${config.openai.apiKey}`,
+          'OpenAI-Beta': 'realtime=v1',
+        },
+      });
+
+      ws.on('open', () => {
+        this.logger.log(`OpenAI Realtime connected for call ${callSid}`);
+
+        // Initialize session
+        ws.send(JSON.stringify({
+          type: 'session.update',
+          session: {
+            model: config.openai.model || 'gpt-4o-realtime-preview',
+            voice: config.openai.voice || 'alloy',
+            instructions: 'You are a helpful AI assistant providing real-time support during phone calls. Provide concise, actionable suggestions to help the user.',
+            turn_detection: {
+              type: 'server_vad',
+            },
+            tools: this.getOpenAITools(),
+          },
+        }));
+      });
+
+      ws.on('message', (data: Buffer) => {
+        this.handleOpenAIMessage(callSid, tenantId, userId, JSON.parse(data.toString()));
+      });
+
+      ws.on('error', (error) => {
+        this.logger.error(`OpenAI WebSocket error for call ${callSid}`, error);
+      });
+
+      ws.on('close', () => {
+        this.logger.log(`OpenAI Realtime disconnected for call ${callSid}`);
+        this.openaiConnections.delete(callSid);
+      });
+
+      this.openaiConnections.set(callSid, ws);
+    } catch (error) {
+      this.logger.error('Failed to initialize OpenAI Realtime', error);
+    }
+  }
+
+  /**
+   * Handle OpenAI Realtime messages
+   */
+  private async handleOpenAIMessage(
+    callSid: string,
+    tenantId: string,
+    userId: string,
+    message: any,
+  ) {
+    try {
+      switch (message.type) {
+        case 'conversation.item.created':
+          if (message.item.type === 'message' && message.item.role === 'assistant') {
+            // AI response generated
+            this.logger.log(`AI response for call ${callSid}`);
+          }
+          break;
+
+        case 'response.audio_transcript.delta':
+          // Real-time transcript
+          // TODO: Emit to gateway
+          break;
+
+        case 'response.audio_transcript.done':
+          // Final transcript
+          const transcript = message.transcript;
+          await this.updateCallTranscript(callSid, tenantId, transcript);
+          break;
+
+        case 'response.function_call_arguments.done':
+          // Tool call completed
+          await this.handleToolCall(callSid, tenantId, userId, message);
+          break;
+
+        default:
+          // Handle other message types
+          break;
+      }
+    } catch (error) {
+      this.logger.error('Failed to handle OpenAI message', error);
+    }
+  }
+
+  /**
+   * Define OpenAI tools for CRM actions
+   */
+  private getOpenAITools(): any[] {
+    return [
+      {
+        type: 'function',
+        name: 'search_contact',
+        description: 'Search for a contact by name, email, or phone number',
+        parameters: {
+          type: 'object',
+          properties: {
+            query: {
+              type: 'string',
+              description: 'Search query (name, email, or phone)',
+            },
+          },
+          required: ['query'],
+        },
+      },
+      {
+        type: 'function',
+        name: 'create_task',
+        description: 'Create a follow-up task based on the call',
+        parameters: {
+          type: 'object',
+          properties: {
+            title: {
+              type: 'string',
+              description: 'Task title',
+            },
+            description: {
+              type: 'string',
+              description: 'Task description',
+            },
+            dueDate: {
+              type: 'string',
+              description: 'Due date (ISO format)',
+            },
+          },
+          required: ['title'],
+        },
+      },
+      {
+        type: 'function',
+        name: 'update_contact',
+        description: 'Update contact information',
+        parameters: {
+          type: 'object',
+          properties: {
+            contactId: {
+              type: 'string',
+              description: 'Contact ID',
+            },
+            fields: {
+              type: 'object',
+              description: 'Fields to update',
+            },
+          },
+          required: ['contactId', 'fields'],
+        },
+      },
+    ];
+  }
+
+  /**
+   * Handle tool calls from OpenAI
+   */
+  private async handleToolCall(
+    callSid: string,
+    tenantId: string,
+    userId: string,
+    message: any,
+  ) {
+    // TODO: Implement actual tool execution
+    // This would call the appropriate services based on the tool name
+    // Respecting RBAC permissions for the user
+    this.logger.log(`Tool call for call ${callSid}: ${message.name}`);
+  }
+
+  /**
+   * Update call transcript
+   */
+  private async updateCallTranscript(
+    callSid: string,
+    tenantId: string,
+    transcript: string,
+  ) {
+    try {
+      const tenantKnex = await this.tenantDbService.getTenantKnexById(tenantId);
+      await tenantKnex('calls')
+        .where({ call_sid: callSid })
+        .update({
+          ai_transcript: transcript,
+          updated_at: tenantKnex.fn.now(),
+        });
+    } catch (error) {
+      this.logger.error('Failed to update transcript', error);
+    }
+  }
+
+  /**
+   * Get call history for user
+   */
+  async getCallHistory(tenantId: string, userId: string, limit = 50) {
+    try {
+      const tenantKnex = await this.tenantDbService.getTenantKnexById(tenantId);
+      const calls = await tenantKnex('calls')
+        .where({ user_id: userId })
+        .orderBy('created_at', 'desc')
+        .limit(limit);
+
+      return calls;
+    } catch (error) {
+      this.logger.error('Failed to get call history', error);
+      throw error;
+    }
+  }
+}

docs/SALESFORCE_AUTHORIZATION.md

@@ -0,0 +1,211 @@
+# Salesforce-Style Authorization System
+
+## Overview
+Implemented a comprehensive authorization system based on Salesforce's model with:
+- **Org-Wide Defaults (OWD)** for record visibility
+- **Role-based permissions** for object and field access
+- **Record sharing** for granular access control
+- **CASL** for flexible permission evaluation
+
+## Architecture
+
+### 1. Org-Wide Defaults (OWD)
+Controls baseline record visibility for each object:
+- `private`: Only owner can see records
+- `public_read`: Everyone can see, only owner can edit/delete
+- `public_read_write`: Everyone can see and modify all records
+
+### 2. Role-Based Object Permissions
+Table: `role_object_permissions`
+- `canCreate`: Can create new records
+- `canRead`: Can read records (subject to OWD)
+- `canEdit`: Can edit records (subject to OWD)
+- `canDelete`: Can delete records (subject to OWD)
+- `canViewAll`: Override OWD to see ALL records
+- `canModifyAll`: Override OWD to edit ALL records
+
+### 3. Field-Level Security
+Table: `role_field_permissions`
+- `canRead`: Can view field value
+- `canEdit`: Can modify field value
+
+### 4. Record Sharing
+Table: `record_shares`
+Grants specific users access to individual records with:
+```json
+{
+  "canRead": boolean,
+  "canEdit": boolean,
+  "canDelete": boolean
+}
+```
+
+## Permission Evaluation Flow
+
+```
+1. Check role_object_permissions
+   ├─ Does user have canCreate/Read/Edit/Delete?
+   │  └─ NO → Deny
+   │  └─ YES → Continue
+   │
+2. Check canViewAll / canModifyAll
+   ├─ Does user have special "all" permissions?
+   │  └─ YES → Grant access
+   │  └─ NO → Continue
+   │
+3. Check OWD (orgWideDefault)
+   ├─ public_read_write → Grant access
+   ├─ public_read → Grant read, check ownership for write
+   └─ private → Check ownership or sharing
+   
+4. Check Ownership
+   ├─ Is user the record owner?
+   │  └─ YES → Grant access
+   │  └─ NO → Continue
+   │
+5. Check Record Shares
+   └─ Is record explicitly shared with user?
+      └─ Check accessLevel permissions
+```
+
+## Field-Level Security
+
+Fields are filtered after record access is granted:
+1. User queries records → Apply record-level scope
+2. System filters readable fields based on `role_field_permissions`
+3. User updates records → System filters editable fields
+
+## Key Features
+
+### Multiple Role Support
+- Users can have multiple roles
+- Permissions are **unioned** (any role grants = user has it)
+- More flexible than Salesforce's single profile model
+
+### Active Share Detection
+- Shares can expire (`expiresAt`)
+- Shares can be revoked (`revokedAt`)
+- Only active shares are evaluated
+
+### CASL Integration
+- Dynamic ability building per request
+- Condition-based rules
+- Field-level permission support
+
+## Usage Example
+
+```typescript
+// In a controller/service
+constructor(
+  private authService: AuthorizationService,
+  private tenantDbService: TenantDatabaseService,
+) {}
+
+async getRecords(tenantId: string, objectApiName: string, userId: string) {
+  const knex = await this.tenantDbService.getTenantKnex(tenantId);
+  
+  // Get user with roles
+  const user = await User.query(knex)
+    .findById(userId)
+    .withGraphFetched('[roles.[objectPermissions, fieldPermissions]]');
+  
+  // Get object definition
+  const objectDef = await ObjectDefinition.query(knex)
+    .findOne({ apiName: objectApiName });
+  
+  // Build query with authorization scope
+  let query = knex(objectApiName.toLowerCase());
+  query = await this.authService.applyScopeToQuery(
+    query,
+    objectDef,
+    user,
+    'read',
+    knex,
+  );
+  
+  const records = await query;
+  
+  // Get field definitions
+  const fields = await FieldDefinition.query(knex)
+    .where('objectDefinitionId', objectDef.id);
+  
+  // Filter fields user can read
+  const filteredRecords = await Promise.all(
+    records.map(record => 
+      this.authService.filterReadableFields(record, fields, user)
+    )
+  );
+  
+  return filteredRecords;
+}
+
+async updateRecord(tenantId: string, objectApiName: string, recordId: string, data: any, userId: string) {
+  const knex = await this.tenantDbService.getTenantKnex(tenantId);
+  
+  const user = await User.query(knex)
+    .findById(userId)
+    .withGraphFetched('[roles.[objectPermissions, fieldPermissions]]');
+  
+  const objectDef = await ObjectDefinition.query(knex)
+    .findOne({ apiName: objectApiName });
+  
+  // Get existing record
+  const record = await knex(objectApiName.toLowerCase())
+    .where({ id: recordId })
+    .first();
+  
+  if (!record) {
+    throw new NotFoundException('Record not found');
+  }
+  
+  // Check if user can update this record
+  await this.authService.assertCanPerformAction(
+    'update',
+    objectDef,
+    record,
+    user,
+    knex,
+  );
+  
+  // Get field definitions
+  const fields = await FieldDefinition.query(knex)
+    .where('objectDefinitionId', objectDef.id);
+  
+  // Filter to only editable fields
+  const editableData = await this.authService.filterEditableFields(
+    data,
+    fields,
+    user,
+  );
+  
+  // Perform update
+  await knex(objectApiName.toLowerCase())
+    .where({ id: recordId })
+    .update(editableData);
+  
+  return knex(objectApiName.toLowerCase())
+    .where({ id: recordId })
+    .first();
+}
+```
+
+## Migration
+
+Run the migration to add authorization tables:
+```bash
+npm run knex migrate:latest
+```
+
+The migration creates:
+- `orgWideDefault` column in `object_definitions`
+- `role_object_permissions` table
+- `role_field_permissions` table
+- `record_shares` table
+
+## Next Steps
+
+1. **Migrate existing data**: Set default `orgWideDefault` values for existing objects
+2. **Create default roles**: Create Admin, Standard User, etc. with appropriate permissions
+3. **Update API endpoints**: Integrate authorization service into all CRUD operations
+4. **UI for permission management**: Build admin interface to manage role permissions
+5. **Sharing UI**: Build interface for users to share records with others

docs/SOFTPHONE_CHECKLIST.md

@@ -0,0 +1,219 @@
+# Softphone Configuration Checklist
+
+## Pre-Deployment Checklist
+
+### Backend Configuration
+
+- [ ] **Environment Variables Set**
+  - [ ] `BACKEND_URL` - Public URL of backend (e.g., `https://api.yourdomain.com`)
+  - [ ] `ENCRYPTION_KEY` - 32-byte hex key for encrypting credentials
+  - [ ] Database connection URLs configured
+
+- [ ] **Dependencies Installed**
+  ```bash
+  cd backend
+  npm install
+  ```
+
+- [ ] **Migrations Run**
+  ```bash
+  # Generate Prisma client
+  npx prisma generate --schema=./prisma/schema-central.prisma
+  
+  # Run tenant migrations (creates calls table)
+  npm run migrate:all-tenants
+  ```
+
+- [ ] **Build Succeeds**
+  ```bash
+  npm run build
+  ```
+
+### Frontend Configuration
+
+- [ ] **Environment Variables Set**
+  - [ ] `VITE_BACKEND_URL` - Backend URL (e.g., `https://api.yourdomain.com`)
+
+- [ ] **Dependencies Installed**
+  ```bash
+  cd frontend
+  npm install
+  ```
+
+- [ ] **Build Succeeds**
+  ```bash
+  npm run build
+  ```
+
+### Twilio Setup
+
+- [ ] **Account Created**
+  - [ ] Sign up at https://www.twilio.com
+  - [ ] Verify account (phone/email)
+
+- [ ] **Credentials Retrieved**
+  - [ ] Account SID (starts with `AC...`)
+  - [ ] Auth Token (from Twilio Console)
+
+- [ ] **Phone Number Purchased**
+  - [ ] Buy a phone number in Twilio Console
+  - [ ] Note the phone number in E.164 format (e.g., `+1234567890`)
+
+- [ ] **Webhooks Configured**
+  - [ ] Go to Phone Numbers → Active Numbers → [Your Number]
+  - [ ] Voice Configuration:
+    - [ ] A CALL COMES IN: Webhook
+    - [ ] URL: `https://your-backend-url.com/api/voice/twiml/inbound`
+    - [ ] HTTP: POST
+  - [ ] Status Callback:
+    - [ ] URL: `https://your-backend-url.com/api/voice/webhook/status`
+    - [ ] HTTP: POST
+
+- [ ] **Media Streams (Optional)**
+  - [ ] Enable Media Streams in Twilio Console
+  - [ ] Note: Full implementation pending
+
+### OpenAI Setup (Optional)
+
+- [ ] **API Key Obtained**
+  - [ ] Sign up at https://platform.openai.com
+  - [ ] Create API key in API Keys section
+  - [ ] Copy key (starts with `sk-...`)
+
+- [ ] **Realtime API Access**
+  - [ ] Ensure account has access to Realtime API (beta feature)
+  - [ ] Contact OpenAI support if needed
+
+- [ ] **Model & Voice Selected**
+  - [ ] Model: `gpt-4o-realtime-preview` (default)
+  - [ ] Voice: `alloy`, `echo`, `fable`, `onyx`, `nova`, or `shimmer`
+
+### Tenant Configuration
+
+- [ ] **Log into Tenant**
+  - [ ] Use tenant subdomain (e.g., `acme.yourdomain.com`)
+  - [ ] Login with tenant user account
+
+- [ ] **Navigate to Integrations**
+  - [ ] Go to Settings → Integrations (create page if doesn't exist)
+
+- [ ] **Configure Twilio**
+  - [ ] Enter Account SID
+  - [ ] Enter Auth Token
+  - [ ] Enter Phone Number (with country code)
+  - [ ] Click Save Configuration
+
+- [ ] **Configure OpenAI (Optional)**
+  - [ ] Enter API Key
+  - [ ] Set Model (or use default)
+  - [ ] Set Voice (or use default)
+  - [ ] Click Save Configuration
+
+### Testing
+
+- [ ] **WebSocket Connection**
+  - [ ] Open browser DevTools → Network → WS
+  - [ ] Click "Softphone" button in sidebar
+  - [ ] Verify WebSocket connection to `/voice` namespace
+  - [ ] Check for "Connected" status in softphone dialog
+
+- [ ] **Outbound Call**
+  - [ ] Enter a test phone number
+  - [ ] Click "Call"
+  - [ ] Verify call initiates
+  - [ ] Check call appears in Twilio Console → Logs
+  - [ ] Verify call status updates in UI
+
+- [ ] **Inbound Call**
+  - [ ] Call your Twilio number from external phone
+  - [ ] Verify incoming call notification appears
+  - [ ] Verify ringtone plays
+  - [ ] Click "Accept"
+  - [ ] Verify call connects
+
+- [ ] **AI Features (if OpenAI configured)**
+  - [ ] Make a call
+  - [ ] Speak during call
+  - [ ] Verify transcript appears in real-time
+  - [ ] Check for AI suggestions
+  - [ ] Test AI tool calls (if configured)
+
+- [ ] **Call History**
+  - [ ] Make/receive multiple calls
+  - [ ] Open softphone dialog
+  - [ ] Verify recent calls appear
+  - [ ] Click recent call to redial
+
+### Production Readiness
+
+- [ ] **Security**
+  - [ ] HTTPS enabled on backend
+  - [ ] WSS (WebSocket Secure) working
+  - [ ] CORS configured correctly
+  - [ ] Environment variables secured
+
+- [ ] **Monitoring**
+  - [ ] Backend logs accessible
+  - [ ] Error tracking setup (e.g., Sentry)
+  - [ ] Twilio logs monitored
+
+- [ ] **Scalability**
+  - [ ] Redis configured for BullMQ (future)
+  - [ ] Database connection pooling configured
+  - [ ] Load balancer if needed
+
+- [ ] **Documentation**
+  - [ ] User guide shared with team
+  - [ ] Twilio credentials documented securely
+  - [ ] Support process defined
+
+## Verification Commands
+
+```bash
+# Check backend build
+cd backend && npm run build
+
+# Check frontend build  
+cd frontend && npm run build
+
+# Verify migrations
+cd backend && npm run migrate:status
+
+# Test WebSocket (after starting backend)
+# In browser console:
+const socket = io('http://localhost:3000/voice', {
+  auth: { token: 'YOUR_JWT_TOKEN' }
+});
+socket.on('connect', () => console.log('Connected!'));
+```
+
+## Common Issues & Solutions
+
+| Issue | Check | Solution |
+|-------|-------|----------|
+| "Not connected" | WebSocket URL | Verify BACKEND_URL in frontend .env |
+| Build fails | Dependencies | Run `npm install` again |
+| Twilio errors | Credentials | Re-enter credentials in settings |
+| No AI features | OpenAI key | Add API key in integrations |
+| Webhook 404 | URL format | Ensure `/api/voice/...` prefix |
+| HTTPS required | Twilio webhooks | Deploy with HTTPS or use ngrok for testing |
+
+## Post-Deployment Tasks
+
+- [ ] Train users on softphone features
+- [ ] Monitor call quality and errors
+- [ ] Collect feedback for improvements
+- [ ] Plan for scaling (queue system, routing)
+- [ ] Review call logs for insights
+
+## Support Resources
+
+- **Twilio Docs**: https://www.twilio.com/docs
+- **OpenAI Realtime API**: https://platform.openai.com/docs/guides/realtime
+- **Project Docs**: `/docs/SOFTPHONE_IMPLEMENTATION.md`
+- **Quick Start**: `/docs/SOFTPHONE_QUICK_START.md`
+
+---
+
+**Last Updated**: January 3, 2026
+**Checklist Version**: 1.0

docs/SOFTPHONE_IMPLEMENTATION.md

@@ -0,0 +1,370 @@
+# Softphone Implementation with Twilio & OpenAI Realtime
+
+## Overview
+
+This implementation adds comprehensive voice calling functionality to the platform using Twilio for telephony and OpenAI Realtime API for AI-assisted calls. The softphone is accessible globally through a Vue component, with call state managed via WebSocket connections.
+
+## Architecture
+
+### Backend (NestJS + Fastify)
+
+#### Core Components
+
+1. **VoiceModule** (`backend/src/voice/`)
+   - `voice.module.ts` - Module configuration
+   - `voice.gateway.ts` - WebSocket gateway for real-time signaling
+   - `voice.service.ts` - Business logic for call orchestration
+   - `voice.controller.ts` - REST endpoints and Twilio webhooks
+   - `dto/` - Data transfer objects for type safety
+   - `interfaces/` - TypeScript interfaces for configuration
+
+2. **Database Schema**
+   - **Central Database**: `integrationsConfig` JSON field in Tenant model (encrypted)
+   - **Tenant Database**: `calls` table for call history and metadata
+
+3. **WebSocket Gateway**
+   - Namespace: `/voice`
+   - Authentication: JWT token validation in handshake
+   - Tenant Context: Extracted from JWT payload
+   - Events: `call:initiate`, `call:accept`, `call:reject`, `call:end`, `call:dtmf`
+   - AI Events: `ai:transcript`, `ai:suggestion`, `ai:action`
+
+4. **Twilio Integration**
+   - SDK: `twilio` npm package
+   - Features: Outbound calls, TwiML responses, Media Streams, webhooks
+   - Credentials: Stored encrypted per tenant in `integrationsConfig.twilio`
+
+5. **OpenAI Realtime Integration**
+   - Connection: WebSocket to `wss://api.openai.com/v1/realtime`
+   - Features: Real-time transcription, AI suggestions, tool calling
+   - Credentials: Stored encrypted per tenant in `integrationsConfig.openai`
+
+### Frontend (Nuxt 3 + Vue 3)
+
+#### Core Components
+
+1. **useSoftphone Composable** (`frontend/composables/useSoftphone.ts`)
+   - Module-level shared state for global access
+   - WebSocket connection management with auto-reconnect
+   - Call state management (current call, incoming call)
+   - Audio management (ringtone playback)
+   - Event handlers for call lifecycle and AI events
+
+2. **SoftphoneDialog Component** (`frontend/components/SoftphoneDialog.vue`)
+   - Global dialog accessible from anywhere
+   - Features:
+     - Dialer with numeric keypad
+     - Incoming call notifications with ringtone
+     - Active call controls (mute, DTMF, hang up)
+     - Real-time transcript display
+     - AI suggestions panel
+     - Recent call history
+
+3. **Integration in Layout** (`frontend/layouts/default.vue`)
+   - SoftphoneDialog included globally
+   - Sidebar button with incoming call indicator
+
+4. **Settings Page** (`frontend/pages/settings/integrations.vue`)
+   - Configure Twilio credentials
+   - Configure OpenAI API settings
+   - Encrypted storage via backend API
+
+## Configuration
+
+### Environment Variables
+
+#### Backend (.env)
+```env
+BACKEND_URL=http://localhost:3000
+ENCRYPTION_KEY=your-32-byte-hex-key
+```
+
+#### Frontend (.env)
+```env
+VITE_BACKEND_URL=http://localhost:3000
+```
+
+### Tenant Configuration
+
+Integrations are configured per tenant via the settings UI or API:
+
+```json
+{
+  "twilio": {
+    "accountSid": "ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
+    "authToken": "your-auth-token",
+    "phoneNumber": "+1234567890"
+  },
+  "openai": {
+    "apiKey": "sk-...",
+    "model": "gpt-4o-realtime-preview",
+    "voice": "alloy"
+  }
+}
+```
+
+This configuration is encrypted using AES-256-CBC and stored in the central database.
+
+## API Endpoints
+
+### REST Endpoints
+
+- `POST /api/voice/call` - Initiate outbound call
+- `GET /api/voice/calls` - Get call history
+- `POST /api/voice/twiml/outbound` - TwiML for outbound calls
+- `POST /api/voice/twiml/inbound` - TwiML for inbound calls
+- `POST /api/voice/webhook/status` - Twilio status webhook
+- `POST /api/voice/webhook/recording` - Twilio recording webhook
+- `GET /api/tenant/integrations` - Get integrations config (masked)
+- `PUT /api/tenant/integrations` - Update integrations config
+
+### WebSocket Events
+
+#### Client → Server
+- `call:initiate` - Initiate outbound call
+- `call:accept` - Accept incoming call
+- `call:reject` - Reject incoming call
+- `call:end` - End active call
+- `call:dtmf` - Send DTMF tone
+
+#### Server → Client
+- `call:incoming` - Incoming call notification
+- `call:initiated` - Call initiation confirmed
+- `call:accepted` - Call accepted
+- `call:rejected` - Call rejected
+- `call:ended` - Call ended
+- `call:update` - Call status update
+- `call:error` - Call error
+- `call:state` - Full call state sync
+- `ai:transcript` - AI transcription update
+- `ai:suggestion` - AI suggestion
+- `ai:action` - AI action executed
+
+## Database Schema
+
+### Central Database - Tenant Model
+
+```prisma
+model Tenant {
+  id                 String   @id @default(cuid())
+  name               String
+  slug               String   @unique
+  dbHost             String
+  dbPort             Int      @default(3306)
+  dbName             String
+  dbUsername         String
+  dbPassword         String   // Encrypted
+  integrationsConfig Json?    // NEW: Encrypted JSON config
+  status             String   @default("active")
+  createdAt          DateTime @default(now())
+  updatedAt          DateTime @updatedAt
+  
+  domains            Domain[]
+}
+```
+
+### Tenant Database - Calls Table
+
+```sql
+CREATE TABLE calls (
+  id VARCHAR(36) PRIMARY KEY,
+  call_sid VARCHAR(100) UNIQUE NOT NULL,
+  direction ENUM('inbound', 'outbound') NOT NULL,
+  from_number VARCHAR(20) NOT NULL,
+  to_number VARCHAR(20) NOT NULL,
+  status ENUM('queued', 'ringing', 'in-progress', 'completed', 'busy', 'failed', 'no-answer', 'canceled'),
+  duration_seconds INT UNSIGNED,
+  recording_url VARCHAR(500),
+  ai_transcript TEXT,
+  ai_summary TEXT,
+  ai_insights JSON,
+  user_id VARCHAR(36) NOT NULL,
+  started_at TIMESTAMP,
+  ended_at TIMESTAMP,
+  created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+  updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  
+  FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
+  INDEX idx_call_sid (call_sid),
+  INDEX idx_user_id (user_id),
+  INDEX idx_status (status),
+  INDEX idx_direction (direction),
+  INDEX idx_created_user (created_at, user_id)
+);
+```
+
+## Usage
+
+### For Developers
+
+1. **Install Dependencies**
+   ```bash
+   cd backend && npm install
+   cd ../frontend && npm install
+   ```
+
+2. **Configure Environment**
+   - Set `ENCRYPTION_KEY` in backend `.env`
+   - Ensure `BACKEND_URL` matches your deployment
+
+3. **Run Migrations**
+   ```bash
+   cd backend
+   # Central database migration is handled by Prisma
+   npm run migrate:all-tenants  # Run tenant migrations
+   ```
+
+4. **Start Services**
+   ```bash
+   # Backend
+   cd backend && npm run start:dev
+   
+   # Frontend
+   cd frontend && npm run dev
+   ```
+
+### For Users
+
+1. **Configure Integrations**
+   - Navigate to Settings → Integrations
+   - Enter Twilio credentials (Account SID, Auth Token, Phone Number)
+   - Enter OpenAI API key
+   - Click "Save Configuration"
+
+2. **Make a Call**
+   - Click the "Softphone" button in the sidebar
+   - Enter a phone number (E.164 format: +1234567890)
+   - Click "Call"
+
+3. **Receive Calls**
+   - Configure Twilio webhook URLs to point to your backend
+   - Incoming calls will trigger a notification and ringtone
+   - Click "Accept" to answer or "Reject" to decline
+
+## Advanced Features
+
+### AI-Assisted Calling
+
+The OpenAI Realtime API provides:
+
+1. **Real-time Transcription** - Live speech-to-text during calls
+2. **AI Suggestions** - Contextual suggestions for agents
+3. **Tool Calling** - CRM actions via AI (search contacts, create tasks, etc.)
+
+### Tool Definitions
+
+The system includes predefined tools for AI:
+
+- `search_contact` - Search CRM for contacts
+- `create_task` - Create follow-up tasks
+- `update_contact` - Update contact information
+
+Tools automatically respect RBAC permissions as they call existing protected services.
+
+### Call Recording
+
+- Automatic recording via Twilio
+- Recording URLs stored in call records
+- Accessible via API for playback
+
+## Security
+
+1. **Encryption** - All credentials encrypted using AES-256-CBC
+2. **Authentication** - JWT-based auth for WebSocket and REST
+3. **Tenant Isolation** - Multi-tenant architecture with database-per-tenant
+4. **RBAC** - Permission-based access control (future: add voice-specific permissions)
+
+## Limitations & Future Enhancements
+
+### Current Limitations
+
+1. **Media Streaming** - Twilio Media Streams WebSocket not fully implemented
+2. **Call Routing** - No intelligent routing for inbound calls yet
+3. **Queue Management** - Basic call handling, no queue system
+4. **Audio Muting** - UI placeholder, actual audio muting not implemented
+5. **RBAC Permissions** - Voice-specific permissions not yet added
+
+### Planned Enhancements
+
+1. **Media Streams** - Full bidirectional audio between Twilio ↔ OpenAI ↔ User
+2. **Call Routing** - Route calls based on availability, skills, round-robin
+3. **Queue System** - Call queuing with BullMQ integration
+4. **Call Analytics** - Dashboard with call metrics and insights
+5. **RBAC Integration** - Add `voice.make_calls`, `voice.receive_calls` permissions
+6. **WebRTC** - Direct browser-to-Twilio audio (bypass backend)
+
+## Troubleshooting
+
+### WebSocket Connection Issues
+
+- Verify `BACKEND_URL` environment variable
+- Check CORS settings in backend
+- Ensure JWT token is valid and includes tenant information
+
+### Twilio Webhook Errors
+
+- Ensure webhook URLs are publicly accessible
+- Verify Twilio credentials in integrations config
+- Check backend logs for webhook processing errors
+
+### OpenAI Connection Issues
+
+- Verify OpenAI API key has Realtime API access
+- Check network connectivity to OpenAI endpoints
+- Monitor backend logs for WebSocket errors
+
+## Testing
+
+### Manual Testing
+
+1. **Outbound Calls**
+   ```bash
+   # Open softphone dialog
+   # Enter test number (use Twilio test credentials)
+   # Click Call
+   # Verify call status updates
+   ```
+
+2. **Inbound Calls**
+   ```bash
+   # Configure Twilio number webhook
+   # Call the Twilio number from external phone
+   # Verify incoming call notification
+   # Accept call and verify connection
+   ```
+
+3. **AI Features**
+   ```bash
+   # Make a call with OpenAI configured
+   # Speak during the call
+   # Verify transcript appears in UI
+   # Check for AI suggestions
+   ```
+
+## Dependencies
+
+### Backend
+- `@nestjs/websockets` - WebSocket support
+- `@nestjs/platform-socket.io` - Socket.IO adapter
+- `@fastify/websocket` - Fastify WebSocket plugin
+- `socket.io` - WebSocket library
+- `twilio` - Twilio SDK
+- `openai` - OpenAI SDK (for Realtime API)
+- `ws` - WebSocket client
+
+### Frontend
+- `socket.io-client` - WebSocket client
+- `lucide-vue-next` - Icons
+- `vue-sonner` - Toast notifications
+
+## Support
+
+For issues or questions:
+1. Check backend logs for error details
+2. Verify tenant integrations configuration
+3. Test Twilio/OpenAI connectivity independently
+4. Review WebSocket connection in browser DevTools
+
+## License
+
+Same as project license.

docs/SOFTPHONE_QUICK_START.md

@@ -0,0 +1,94 @@
+# Softphone Quick Start Guide
+
+## Setup (5 minutes)
+
+### 1. Configure Twilio
+
+1. Create a Twilio account at https://www.twilio.com
+2. Get your credentials:
+   - Account SID (starts with AC...)
+   - Auth Token
+   - Purchase a phone number
+3. Configure webhook URLs in Twilio Console:
+   - Voice webhook: `https://your-domain.com/api/voice/twiml/inbound`
+   - Status callback: `https://your-domain.com/api/voice/webhook/status`
+
+### 2. Configure OpenAI (Optional for AI features)
+
+1. Get OpenAI API key from https://platform.openai.com
+2. Ensure you have access to Realtime API (beta feature)
+
+### 3. Add Credentials to Platform
+
+1. Log into your tenant
+2. Navigate to **Settings → Integrations**
+3. Fill in Twilio section:
+   - Account SID
+   - Auth Token
+   - Phone Number (format: +1234567890)
+4. Fill in OpenAI section (optional):
+   - API Key
+   - Model: `gpt-4o-realtime-preview` (default)
+   - Voice: `alloy` (default)
+5. Click **Save Configuration**
+
+## Using the Softphone
+
+### Make a Call
+
+1. Click **Softphone** button in sidebar (phone icon)
+2. Enter phone number in E.164 format: `+1234567890`
+3. Click **Call** or press Enter
+4. Wait for connection
+5. During call:
+   - Click **hash** icon for DTMF keypad
+   - Click **microphone** to mute/unmute
+   - Click **red phone** to hang up
+
+### Receive a Call
+
+1. Softphone automatically connects when logged in
+2. Incoming call notification appears with ringtone
+3. Click **Accept** (green button) or **Reject** (red button)
+4. If accepted, call controls appear
+
+### AI Features (if OpenAI configured)
+
+- **Real-time Transcript**: See what's being said live
+- **AI Suggestions**: Get contextual tips during calls
+- **Smart Actions**: AI can search contacts, create tasks automatically
+
+## Quick Tips
+
+- ✅ Phone number format: `+1234567890` (include country code)
+- ✅ Close dialog: Click outside or press Escape
+- ✅ Incoming calls work even if dialog is closed
+- ✅ Recent calls appear for quick redial
+- ❌ Don't forget to save credentials before testing
+- ❌ Webhook URLs must be publicly accessible (not localhost)
+
+## Troubleshooting
+
+| Issue | Solution |
+|-------|----------|
+| "Not connected" | Check credentials in Settings → Integrations |
+| Can't make calls | Verify Twilio Account SID and Auth Token |
+| Can't receive calls | Check Twilio webhook configuration |
+| No AI features | Add OpenAI API key in settings |
+| WebSocket errors | Check browser console, verify backend URL |
+
+## Testing with Twilio Test Credentials
+
+For development, Twilio provides test credentials:
+- Use Twilio test numbers
+- No actual calls are made
+- Simulate call flows in development
+
+## Next Steps
+
+- 📞 Make your first test call
+- 🎤 Try the AI transcription feature
+- 📊 View call history in Softphone dialog
+- ⚙️ Configure call routing (advanced)
+
+Need help? Check `/docs/SOFTPHONE_IMPLEMENTATION.md` for detailed documentation.

docs/SOFTPHONE_SUMMARY.md

@@ -0,0 +1,232 @@
+# Softphone Feature - Implementation Summary
+
+## ✅ What Was Implemented
+
+This PR adds complete softphone functionality to the platform with Twilio telephony and OpenAI Realtime API integration.
+
+### Backend Changes
+
+1. **WebSocket Support**
+   - Added `@fastify/websocket` to enable WebSocket in Fastify
+   - Configured `@nestjs/websockets` with Socket.IO adapter
+   - Modified `main.ts` to register WebSocket support
+
+2. **Database Schema**
+   - Added `integrationsConfig` JSON field to Tenant model (encrypted)
+   - Created `calls` table migration for tenant databases
+   - Generated Prisma client with new schema
+
+3. **VoiceModule** (`backend/src/voice/`)
+   - `voice.module.ts` - Module registration
+   - `voice.gateway.ts` - WebSocket gateway with JWT auth
+   - `voice.service.ts` - Twilio & OpenAI integration
+   - `voice.controller.ts` - REST endpoints and webhooks
+   - DTOs and interfaces for type safety
+
+4. **Tenant Management**
+   - `tenant.controller.ts` - New endpoints for integrations config
+   - Encryption/decryption helpers in `tenant-database.service.ts`
+
+### Frontend Changes
+
+1. **Composables**
+   - `useSoftphone.ts` - Global state management with WebSocket
+
+2. **Components**
+   - `SoftphoneDialog.vue` - Full softphone UI with dialer, call controls, AI features
+   - Integrated into `default.vue` layout
+   - Added button to `AppSidebar.vue` with incoming call indicator
+
+3. **Pages**
+   - `settings/integrations.vue` - Configure Twilio and OpenAI credentials
+
+4. **Dependencies**
+   - Added `socket.io-client` for WebSocket connectivity
+
+### Documentation
+
+1. `SOFTPHONE_IMPLEMENTATION.md` - Comprehensive technical documentation
+2. `SOFTPHONE_QUICK_START.md` - User-friendly setup guide
+
+## 🎯 Key Features
+
+- ✅ Outbound calling with dialer
+- ✅ Inbound call notifications with ringtone
+- ✅ Real-time call controls (mute, DTMF, hang up)
+- ✅ Call history tracking
+- ✅ AI-powered transcription (OpenAI Realtime)
+- ✅ AI suggestions during calls
+- ✅ Tool calling for CRM actions
+- ✅ Multi-tenant with encrypted credentials per tenant
+- ✅ WebSocket-based real-time communication
+- ✅ Responsive UI with shadcn-vue components
+
+## 📦 New Dependencies
+
+### Backend
+```json
+{
+  "@fastify/websocket": "^latest",
+  "@nestjs/websockets": "^10.x",
+  "@nestjs/platform-socket.io": "^10.x",
+  "socket.io": "^latest",
+  "twilio": "^latest",
+  "openai": "^latest",
+  "ws": "^latest"
+}
+```
+
+### Frontend
+```json
+{
+  "socket.io-client": "^latest"
+}
+```
+
+## 🚀 Quick Start
+
+### 1. Run Migrations
+```bash
+cd backend
+npx prisma generate --schema=./prisma/schema-central.prisma
+npm run migrate:all-tenants
+```
+
+### 2. Configure Tenant
+1. Log into tenant account
+2. Go to Settings → Integrations
+3. Add Twilio credentials (Account SID, Auth Token, Phone Number)
+4. Add OpenAI API key (optional, for AI features)
+5. Save configuration
+
+### 3. Use Softphone
+1. Click "Softphone" button in sidebar
+2. Enter phone number and click "Call"
+3. Or receive incoming calls automatically
+
+## 🔐 Security
+
+- All credentials encrypted with AES-256-CBC
+- JWT authentication for WebSocket connections
+- Tenant isolation via database-per-tenant architecture
+- Sensitive fields masked in API responses
+
+## 📊 Database Changes
+
+### Central Database
+```sql
+ALTER TABLE tenants ADD COLUMN integrationsConfig JSON;
+```
+
+### Tenant Databases
+```sql
+CREATE TABLE calls (
+  id VARCHAR(36) PRIMARY KEY,
+  call_sid VARCHAR(100) UNIQUE NOT NULL,
+  direction ENUM('inbound', 'outbound'),
+  from_number VARCHAR(20),
+  to_number VARCHAR(20),
+  status VARCHAR(20),
+  duration_seconds INT,
+  recording_url VARCHAR(500),
+  ai_transcript TEXT,
+  ai_summary TEXT,
+  ai_insights JSON,
+  user_id VARCHAR(36),
+  started_at TIMESTAMP,
+  ended_at TIMESTAMP,
+  created_at TIMESTAMP,
+  updated_at TIMESTAMP,
+  FOREIGN KEY (user_id) REFERENCES users(id)
+);
+```
+
+## 🎨 UI Components
+
+- **SoftphoneDialog**: Main softphone interface
+  - Dialer with numeric keypad
+  - Incoming call banner with accept/reject
+  - Active call controls
+  - Real-time transcript view
+  - AI suggestions panel
+  - Recent calls list
+
+- **Sidebar Integration**: Phone button with notification badge
+
+## 🔄 API Endpoints
+
+### REST
+- `POST /api/voice/call` - Initiate call
+- `GET /api/voice/calls` - Get call history
+- `GET /api/tenant/integrations` - Get config
+- `PUT /api/tenant/integrations` - Update config
+
+### WebSocket (`/voice` namespace)
+- `call:initiate` - Start outbound call
+- `call:accept` - Accept incoming call
+- `call:reject` - Reject incoming call
+- `call:end` - End active call
+- `call:dtmf` - Send DTMF tone
+- `ai:transcript` - Receive transcription
+- `ai:suggestion` - Receive AI suggestion
+
+## ⚠️ Known Limitations
+
+1. **Media Streaming**: Twilio Media Streams WebSocket not fully implemented
+2. **Call Routing**: Basic inbound call handling (no intelligent routing yet)
+3. **RBAC**: Voice-specific permissions not yet integrated
+4. **Audio Muting**: UI present but actual audio muting not implemented
+5. **Queue System**: No call queue management (single call at a time)
+
+## 🔮 Future Enhancements
+
+1. Full Twilio Media Streams integration for audio forking
+2. Intelligent call routing (availability-based, round-robin, skills-based)
+3. Call queue management with BullMQ
+4. RBAC permissions (`voice.make_calls`, `voice.receive_calls`)
+5. WebRTC for browser-based audio
+6. Call analytics dashboard
+7. IVR (Interactive Voice Response) system
+8. Call recording download and playback
+9. Voicemail support
+
+## 🧪 Testing
+
+### Manual Testing Checklist
+- [ ] Install dependencies
+- [ ] Run migrations
+- [ ] Configure Twilio credentials
+- [ ] Make outbound call
+- [ ] Receive inbound call (requires public webhook URL)
+- [ ] Test call controls (mute, DTMF, hang up)
+- [ ] Configure OpenAI and test AI features
+- [ ] Check call history
+- [ ] Test on multiple browsers
+
+### Twilio Test Mode
+Use Twilio test credentials for development without making real calls.
+
+## 📚 Documentation
+
+See `/docs/` for detailed documentation:
+- `SOFTPHONE_IMPLEMENTATION.md` - Technical details
+- `SOFTPHONE_QUICK_START.md` - User guide
+
+## 🐛 Troubleshooting
+
+| Issue | Solution |
+|-------|----------|
+| Build errors | Run `npm install` in both backend and frontend |
+| WebSocket connection fails | Check BACKEND_URL env variable |
+| Calls not working | Verify Twilio credentials in Settings → Integrations |
+| AI features not working | Add OpenAI API key in integrations settings |
+
+## 👥 Contributors
+
+Implemented by: GitHub Copilot (Claude Sonnet 4.5)
+
+---
+
+**Status**: ✅ Ready for testing
+**Version**: 1.0.0
+**Date**: January 3, 2026

frontend/components/AppSidebar.vue

@@ -17,10 +17,12 @@ import {
   SidebarRail,
 } from '@/components/ui/sidebar'
 import { Collapsible, CollapsibleContent, CollapsibleTrigger } from '@/components/ui/collapsible'
-import { LayoutGrid, Boxes, Settings, Home, ChevronRight, Database, Layers, LogOut, Users, Globe, Building } from 'lucide-vue-next'
+import { LayoutGrid, Boxes, Settings, Home, ChevronRight, Database, Layers, LogOut, Users, Globe, Building, Phone } from 'lucide-vue-next'
+import { useSoftphone } from '~/composables/useSoftphone'
 
 const { logout } = useAuth()
 const { api } = useApi()
+const softphone = useSoftphone()
 
 const handleLogout = async () => {
   await logout()
@@ -105,6 +107,16 @@ const staticMenuItems = [
         url: '/setup/objects',
         icon: Boxes,
       },
+      {
+        title: 'Users',
+        url: '/setup/users',
+        icon: Users,
+      },
+      {
+        title: 'Roles',
+        url: '/setup/roles',
+        icon: Layers,
+      },
     ],
   },
 ]
@@ -318,6 +330,13 @@ const centralAdminMenuItems: Array<{
     </SidebarContent>
     <SidebarFooter>
       <SidebarMenu>
+        <SidebarMenuItem v-if="!isCentralAdmin">
+          <SidebarMenuButton @click="softphone.open" class="cursor-pointer hover:bg-accent">
+            <Phone class="h-4 w-4" />
+            <span>Softphone</span>
+            <span v-if="softphone.hasIncomingCall.value" class="ml-auto h-2 w-2 rounded-full bg-red-500 animate-pulse"></span>
+          </SidebarMenuButton>
+        </SidebarMenuItem>
         <SidebarMenuItem>
           <SidebarMenuButton @click="handleLogout" class="cursor-pointer hover:bg-accent">
             <LogOut class="h-4 w-4" />

frontend/components/FieldLevelSecurity.vue

@@ -0,0 +1,344 @@
+<template>
+  <Card>
+    <CardHeader>
+      <CardTitle>Field-Level Security</CardTitle>
+      <CardDescription>
+        Control which fields each role can read and edit
+      </CardDescription>
+    </CardHeader>
+    <CardContent>
+      <div v-if="loading" class="flex items-center justify-center py-8">
+        <div class="animate-spin rounded-full h-8 w-8 border-b-2 border-primary"></div>
+      </div>
+
+      <div v-else-if="roles.length === 0" class="text-sm text-muted-foreground py-4">
+        No roles available. Create roles first to manage field-level permissions.
+      </div>
+
+      <div v-else class="space-y-6">
+        <!-- Role Selector -->
+        <div class="space-y-2">
+          <Label>Select Role</Label>
+          <Select v-model="selectedRoleId" @update:model-value="(value) => selectedRoleId = value">
+            <SelectTrigger class="w-full">
+              <SelectValue placeholder="Choose a role to configure permissions" />
+            </SelectTrigger>
+            <SelectContent>
+              <SelectItem v-for="role in roles" :key="role.id" :value="role.id">
+                {{ role.name }}
+              </SelectItem>
+            </SelectContent>
+          </Select>
+        </div>
+
+        <!-- Object-Level Permissions -->
+        <div v-if="selectedRoleId" class="space-y-2">
+          <h3 class="text-sm font-medium">Object-Level Permissions</h3>
+          <div class="rounded-md border">
+            <table class="w-full">
+              <thead>
+                <tr class="border-b bg-muted/50">
+                  <th class="p-3 text-left font-medium">Permission</th>
+                  <th class="p-3 text-center font-medium">Enabled</th>
+                </tr>
+              </thead>
+              <tbody>
+                <tr class="border-b hover:bg-muted/30">
+                  <td class="p-3">Create</td>
+                  <td class="p-3 text-center">
+                    <Checkbox
+                      :model-value="objectPermissions.canCreate"
+                      @update:model-value="(checked: boolean) => updateObjectPermission('canCreate', checked)"
+                    />
+                  </td>
+                </tr>
+                <tr class="border-b hover:bg-muted/30">
+                  <td class="p-3">Read</td>
+                  <td class="p-3 text-center">
+                    <Checkbox
+                      :model-value="objectPermissions.canRead"
+                      @update:model-value="(checked: boolean) => updateObjectPermission('canRead', checked)"
+                    />
+                  </td>
+                </tr>
+                <tr class="border-b hover:bg-muted/30">
+                  <td class="p-3">Edit</td>
+                  <td class="p-3 text-center">
+                    <Checkbox
+                      :model-value="objectPermissions.canEdit"
+                      @update:model-value="(checked: boolean) => updateObjectPermission('canEdit', checked)"
+                    />
+                  </td>
+                </tr>
+                <tr class="border-b hover:bg-muted/30">
+                  <td class="p-3">Delete</td>
+                  <td class="p-3 text-center">
+                    <Checkbox
+                      :model-value="objectPermissions.canDelete"
+                      @update:model-value="(checked: boolean) => updateObjectPermission('canDelete', checked)"
+                    />
+                  </td>
+                </tr>
+                <tr class="border-b hover:bg-muted/30">
+                  <td class="p-3">View All</td>
+                  <td class="p-3 text-center">
+                    <Checkbox
+                      :model-value="objectPermissions.canViewAll"
+                      @update:model-value="(checked: boolean) => updateObjectPermission('canViewAll', checked)"
+                    />
+                  </td>
+                </tr>
+                <tr class="hover:bg-muted/30">
+                  <td class="p-3">Modify All</td>
+                  <td class="p-3 text-center">
+                    <Checkbox
+                      :model-value="objectPermissions.canModifyAll"
+                      @update:model-value="(checked: boolean) => updateObjectPermission('canModifyAll', checked)"
+                    />
+                  </td>
+                </tr>
+              </tbody>
+            </table>
+          </div>
+        </div>
+
+        <!-- Field-Level Permissions -->
+        <div v-if="selectedRoleId" class="space-y-2">
+          <h3 class="text-sm font-medium">Field-Level Permissions</h3>
+          <div class="rounded-md border">
+            <table class="w-full">
+              <thead>
+                <tr class="border-b bg-muted/50">
+                  <th class="p-3 text-left font-medium">Field</th>
+                  <th class="p-3 text-center font-medium">Read</th>
+                  <th class="p-3 text-center font-medium">Edit</th>
+                </tr>
+              </thead>
+              <tbody>
+                <tr 
+                  v-for="field in fields" 
+                  :key="field.id"
+                  class="border-b hover:bg-muted/30"
+                >
+                  <td class="p-3">
+                    <div>
+                      <div class="font-medium">{{ field.label }}</div>
+                      <div class="text-xs text-muted-foreground">{{ field.apiName }}</div>
+                    </div>
+                  </td>
+                  <td class="p-3 text-center">
+                    <Checkbox
+                      :model-value="hasPermission(field.id, selectedRoleId, 'read')"
+                      @update:model-value="(checked: boolean) => updatePermission(field.id, selectedRoleId, 'read', checked)"
+                      :disabled="field.isSystem"
+                    />
+                  </td>
+                  <td class="p-3 text-center">
+                    <Checkbox
+                      :model-value="hasPermission(field.id, selectedRoleId, 'edit')"
+                      @update:model-value="(checked: boolean) => updatePermission(field.id, selectedRoleId, 'edit', checked)"
+                      :disabled="field.isSystem || !hasPermission(field.id, selectedRoleId, 'read')"
+                    />
+                  </td>
+                </tr>
+              </tbody>
+            </table>
+          </div>
+        </div>
+
+        <div class="flex items-center gap-2 text-sm text-muted-foreground">
+          <Info class="h-4 w-4" />
+          <span>System fields are always readable. Edit permissions require read permission first. Changes save automatically.</span>
+        </div>
+        
+        <div v-if="saving" class="flex items-center gap-2 text-sm text-primary">
+          <div class="animate-spin rounded-full h-4 w-4 border-b-2 border-primary"></div>
+          <span>Saving...</span>
+        </div>
+      </div>
+    </CardContent>
+  </Card>
+</template>
+
+<script setup lang="ts">
+import { ref, onMounted, computed, watch } from 'vue';
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '~/components/ui/card';
+import { Checkbox } from '~/components/ui/checkbox';
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '~/components/ui/select';
+import { Label } from '~/components/ui/label';
+import { Info } from 'lucide-vue-next';
+
+const props = defineProps<{
+  objectId: string;
+  objectApiName: string;
+  fields: any[];
+}>();
+
+const { api } = useApi();
+const { toast } = useToast();
+
+const loading = ref(true);
+const saving = ref(false);
+const roles = ref<any[]>([]);
+const selectedRoleId = ref<string>('');
+const permissions = ref<Map<string, Map<string, { canRead: boolean; canEdit: boolean }>>>(new Map());
+const objectPermissions = ref({
+  canCreate: false,
+  canRead: false,
+  canEdit: false,
+  canDelete: false,
+  canViewAll: false,
+  canModifyAll: false,
+});
+
+// Load roles and permissions
+onMounted(async () => {
+  try {
+    loading.value = true;
+    
+    // Load roles
+    const rolesResponse = await api.get('/setup/roles');
+    roles.value = rolesResponse || [];
+    
+    // Load existing permissions for this object
+    const permsResponse = await api.get(`/setup/objects/${props.objectId}/field-permissions`);
+    
+    // Build permissions map: fieldId -> roleId -> {canRead, canEdit}
+    const permsMap = new Map();
+    if (permsResponse && Array.isArray(permsResponse)) {
+      for (const perm of permsResponse) {
+        if (!permsMap.has(perm.fieldDefinitionId)) {
+          permsMap.set(perm.fieldDefinitionId, new Map());
+        }
+        permsMap.get(perm.fieldDefinitionId).set(perm.roleId, {
+          canRead: Boolean(perm.canRead),
+          canEdit: Boolean(perm.canEdit),
+        });
+      }
+    }
+    permissions.value = permsMap;
+    
+  } catch (error: any) {
+    console.error('Failed to load field permissions:', error);
+    toast.error('Failed to load field permissions');
+  } finally {
+    loading.value = false;
+  }
+});
+
+const hasPermission = (fieldId: string, roleId: string, type: 'read' | 'edit'): boolean => {
+  const fieldPerms = permissions.value.get(fieldId);
+  if (!fieldPerms) return true; // Default to true if no permissions set
+  const rolePerm = fieldPerms.get(roleId);
+  if (!rolePerm) return true; // Default to true if no permissions set
+  const value = type === 'read' ? rolePerm.canRead : rolePerm.canEdit;
+  return Boolean(value); // Convert 1/0 to true/false
+};
+
+const updatePermission = async (fieldId: string, roleId: string, type: 'read' | 'edit', checked: boolean) => {
+  try {
+    saving.value = true;
+    
+    // Get current permissions
+    if (!permissions.value.has(fieldId)) {
+      permissions.value.set(fieldId, new Map());
+    }
+    const fieldPerms = permissions.value.get(fieldId)!;
+    
+    if (!fieldPerms.has(roleId)) {
+      fieldPerms.set(roleId, { canRead: true, canEdit: true });
+    }
+    const perm = fieldPerms.get(roleId)!;
+    
+    // Update permission
+    if (type === 'read') {
+      perm.canRead = checked;
+      // If disabling read, also disable edit
+      if (!checked) {
+        perm.canEdit = false;
+      }
+    } else {
+      perm.canEdit = checked;
+      // If enabling edit, also enable read
+      if (checked) {
+        perm.canRead = true;
+      }
+    }
+    
+    // Save to backend
+    await api.put(`/setup/objects/${props.objectId}/field-permissions`, {
+      roleId,
+      fieldDefinitionId: fieldId,
+      canRead: perm.canRead,
+      canEdit: perm.canEdit,
+    });
+    
+    toast.success('Permission updated');
+    
+  } catch (error: any) {
+    console.error('Failed to update field permission:', error);
+    toast.error(error.message || 'Failed to update permission');
+    
+    // Revert change
+    if (!permissions.value.has(fieldId)) return;
+    const fieldPerms = permissions.value.get(fieldId)!;
+    if (!fieldPerms.has(roleId)) return;
+    const perm = fieldPerms.get(roleId)!;
+    if (type === 'read') {
+      perm.canRead = !checked;
+    } else {
+      perm.canEdit = !checked;
+    }
+  } finally {
+    saving.value = false;
+  }
+};
+
+const updateObjectPermission = async (permission: string, checked: boolean) => {
+  if (!selectedRoleId.value) return;
+  
+  try {
+    saving.value = true;
+    
+    // Update local state
+    (objectPermissions.value as any)[permission] = checked;
+    
+    // Save to backend
+    await api.put(`/setup/objects/${props.objectApiName}/permissions`, {
+      roleId: selectedRoleId.value,
+      ...objectPermissions.value,
+    });
+    
+    toast.success('Object permission updated');
+  } catch (error: any) {
+    console.error('Failed to update object permission:', error);
+    toast.error(error.message || 'Failed to update permission');
+    
+    // Revert change
+    (objectPermissions.value as any)[permission] = !checked;
+  } finally {
+    saving.value = false;
+  }
+};
+
+// Load object permissions when role changes
+watch(selectedRoleId, async (roleId) => {
+  if (!roleId) return;
+  
+  try {
+    const response = await api.get(`/setup/objects/${props.objectApiName}/permissions/${roleId}`);
+    if (response) {
+      objectPermissions.value = {
+        canCreate: Boolean(response.canCreate),
+        canRead: Boolean(response.canRead),
+        canEdit: Boolean(response.canEdit),
+        canDelete: Boolean(response.canDelete),
+        canViewAll: Boolean(response.canViewAll),
+        canModifyAll: Boolean(response.canModifyAll),
+      };
+    }
+  } catch (error: any) {
+    console.error('Failed to load object permissions:', error);
+  }
+});
+</script>

frontend/components/ObjectAccessSettings.vue

@@ -0,0 +1,119 @@
+<template>
+  <div class="space-y-6">
+    <Card>
+      <CardHeader>
+        <CardTitle>Org-Wide Default</CardTitle>
+        <CardDescription>
+          Control the baseline visibility for records of this object
+        </CardDescription>
+      </CardHeader>
+      <CardContent class="space-y-4">
+        <div class="space-y-2">
+          <Label for="orgWideDefault">Record Visibility</Label>
+          <Select v-model="localOrgWideDefault" @update:model-value="handleOrgWideDefaultChange">
+            <SelectTrigger id="orgWideDefault">
+              <SelectValue placeholder="Select visibility level" />
+            </SelectTrigger>
+            <SelectContent>
+              <SelectItem value="private">
+                <div>
+                  <div class="font-semibold">Private</div>
+                  <div class="text-xs text-muted-foreground">Only record owner can see</div>
+                </div>
+              </SelectItem>
+              <SelectItem value="public_read">
+                <div>
+                  <div class="font-semibold">Public Read Only</div>
+                  <div class="text-xs text-muted-foreground">Everyone can read, only owner can edit/delete</div>
+                </div>
+              </SelectItem>
+              <SelectItem value="public_read_write">
+                <div>
+                  <div class="font-semibold">Public Read/Write</div>
+                  <div class="text-xs text-muted-foreground">Everyone can read, edit, and delete all records</div>
+                </div>
+              </SelectItem>
+            </SelectContent>
+          </Select>
+          <p class="text-sm text-muted-foreground">
+            This setting controls who can see records by default. Individual user permissions are granted through roles.
+          </p>
+        </div>
+
+      </CardContent>
+    </Card>
+
+    <FieldLevelSecurity 
+      v-if="objectId && objectApiName && fields && fields.length > 0"
+      :object-id="objectId"
+      :object-api-name="objectApiName"
+      :fields="fields"
+    />
+    
+    <div v-else-if="!objectId" class="text-sm text-muted-foreground">
+      Object ID not available
+    </div>
+    
+    <div v-else-if="!fields || fields.length === 0" class="text-sm text-muted-foreground">
+      No fields available
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref, watch } from 'vue';
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '~/components/ui/card';
+import { Label } from '~/components/ui/label';
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '~/components/ui/select';
+import FieldLevelSecurity from '~/components/FieldLevelSecurity.vue';
+
+const props = defineProps<{
+  objectApiName: string;
+  objectId?: string;
+  orgWideDefault?: string;
+  fields?: any[];
+}>();
+
+const emit = defineEmits<{
+  update: [orgWideDefault: string];
+}>();
+
+const { $api } = useNuxtApp();
+const { showToast } = useToast();
+
+const localOrgWideDefault = ref(props.orgWideDefault || 'private');
+
+// Watch for prop changes
+watch(() => props.orgWideDefault, (newValue) => {
+  if (newValue) {
+    localOrgWideDefault.value = newValue;
+  }
+});
+
+const handleOrgWideDefaultChange = async (value: string) => {
+  try {
+    // Update object definition
+    await $api(`/api/setup/objects/${props.objectApiName}`, {
+      method: 'PATCH',
+      body: {
+        orgWideDefault: value
+      }
+    });
+
+    showToast({
+      title: 'Success',
+      description: 'Org-Wide Default saved successfully',
+      variant: 'default'
+    });
+
+    emit('update', value);
+  } catch (error: any) {
+    console.error('Failed to update org-wide default:', error);
+    showToast({
+      title: 'Error',
+      description: error.data?.message || 'Failed to save changes',
+      variant: 'destructive'
+    });
+  }
+};
+</script>

frontend/components/RecordSharing.vue

@@ -0,0 +1,348 @@
+<template>
+  <div class="record-sharing space-y-4">
+    <div class="flex items-center justify-between">
+      <div>
+        <h3 class="text-lg font-semibold">Sharing</h3>
+        <p class="text-sm text-muted-foreground">
+          Grant access to specific users for this record
+        </p>
+      </div>
+      <Button @click="showShareDialog = true" size="sm">
+        <UserPlus class="h-4 w-4 mr-2" />
+        Share
+      </Button>
+    </div>
+
+    <!-- Loading State -->
+    <div v-if="loading" class="flex items-center justify-center py-8">
+      <div class="animate-spin rounded-full h-8 w-8 border-b-2 border-primary"></div>
+    </div>
+
+    <!-- Error State -->
+    <div v-else-if="error" class="text-sm text-destructive">
+      {{ error }}
+    </div>
+
+    <!-- Shares List -->
+    <div v-else-if="shares.length > 0" class="border rounded-lg">
+      <Table>
+        <TableHeader>
+          <TableRow>
+            <TableHead>User</TableHead>
+            <TableHead>Email</TableHead>
+            <TableHead>Access</TableHead>
+            <TableHead>Shared</TableHead>
+            <TableHead class="text-right">Actions</TableHead>
+          </TableRow>
+        </TableHeader>
+        <TableBody>
+          <TableRow v-for="share in shares" :key="share.id">
+            <TableCell class="font-medium">
+              {{ getUserName(share.granteeUser) }}
+            </TableCell>
+            <TableCell>{{ share.granteeUser.email }}</TableCell>
+            <TableCell>
+              <div class="flex gap-1">
+                <Badge v-if="share.accessLevel.canRead" variant="secondary">Read</Badge>
+                <Badge v-if="share.accessLevel.canEdit" variant="secondary">Edit</Badge>
+                <Badge v-if="share.accessLevel.canDelete" variant="secondary">Delete</Badge>
+              </div>
+            </TableCell>
+            <TableCell>{{ formatDate(share.createdAt) }}</TableCell>
+            <TableCell class="text-right">
+              <Button
+                variant="ghost"
+                size="icon"
+                @click="removeShare(share.id)"
+                :disabled="removing === share.id"
+              >
+                <Trash2 class="h-4 w-4" />
+              </Button>
+            </TableCell>
+          </TableRow>
+        </TableBody>
+      </Table>
+    </div>
+
+    <!-- Empty State -->
+    <div v-else class="text-center py-8 text-muted-foreground border rounded-lg">
+      <Users class="h-12 w-12 mx-auto mb-2 opacity-50" />
+      <p>This record is not shared with anyone</p>
+      <p class="text-sm">Click "Share" to grant access to other users</p>
+    </div>
+
+    <!-- Share Dialog -->
+    <Dialog v-model:open="showShareDialog">
+      <DialogContent>
+        <DialogHeader>
+          <DialogTitle>Share Record</DialogTitle>
+          <DialogDescription>
+            Grant access to this record to specific users
+          </DialogDescription>
+        </DialogHeader>
+        <div class="space-y-4">
+          <div class="space-y-2">
+            <Label for="user">User</Label>
+            <Select v-model="newShare.userId" @update:model-value="(value) => newShare.userId = value">
+              <SelectTrigger>
+                <SelectValue placeholder="Select user" />
+              </SelectTrigger>
+              <SelectContent>
+                <SelectItem
+                  v-for="user in availableUsers"
+                  :key="user.id"
+                  :value="user.id"
+                >
+                  {{ getUserName(user) }} ({{ user.email }})
+                </SelectItem>
+              </SelectContent>
+            </Select>
+          </div>
+
+          <div class="space-y-3">
+            <Label>Permissions</Label>
+            <div class="space-y-2">
+              <div class="flex items-center space-x-2">
+                <Checkbox
+                  id="canRead"
+                  v-model:checked="newShare.canRead"
+                  @update:checked="(value) => newShare.canRead = value"
+                />
+                <label
+                  for="canRead"
+                  class="text-sm font-medium leading-none peer-disabled:cursor-not-allowed peer-disabled:opacity-70"
+                >
+                  Can Read
+                </label>
+              </div>
+              <div class="flex items-center space-x-2">
+                <Checkbox
+                  id="canEdit"
+                  v-model:checked="newShare.canEdit"
+                  @update:checked="(value) => newShare.canEdit = value"
+                />
+                <label
+                  for="canEdit"
+                  class="text-sm font-medium leading-none peer-disabled:cursor-not-allowed peer-disabled:opacity-70"
+                >
+                  Can Edit
+                </label>
+              </div>
+              <div class="flex items-center space-x-2">
+                <Checkbox
+                  id="canDelete"
+                  v-model:checked="newShare.canDelete"
+                  @update:checked="(value) => newShare.canDelete = value"
+                />
+                <label
+                  for="canDelete"
+                  class="text-sm font-medium leading-none peer-disabled:cursor-not-allowed peer-disabled:opacity-70"
+                >
+                  Can Delete
+                </label>
+              </div>
+            </div>
+          </div>
+
+          <div class="space-y-2">
+            <Label for="expiresAt">Expires At (Optional)</Label>
+            <div class="flex gap-2">
+              <DatePicker
+                v-model="expiresDate"
+                placeholder="Select date"
+                class="flex-1"
+              />
+            </div>
+          </div>
+        </div>
+        <DialogFooter>
+          <Button variant="outline" @click="showShareDialog = false">Cancel</Button>
+          <Button
+            @click="createShare"
+            :disabled="!newShare.userId || (!newShare.canRead && !newShare.canEdit && !newShare.canDelete) || sharing"
+          >
+            {{ sharing ? 'Sharing...' : 'Share' }}
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref, onMounted, computed } from 'vue';
+import { Button } from '~/components/ui/button';
+import { Table, TableBody, TableCell, TableHead, TableHeader, TableRow } from '~/components/ui/table';
+import { Dialog, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle } from '~/components/ui/dialog';
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '~/components/ui/select';
+import { Input } from '~/components/ui/input';
+import { Label } from '~/components/ui/label';
+import { Badge } from '~/components/ui/badge';
+import { Checkbox } from '~/components/ui/checkbox';
+import DatePicker from '~/components/ui/date-picker/DatePicker.vue';
+import { UserPlus, Trash2, Users } from 'lucide-vue-next';
+
+interface Props {
+  objectApiName: string;
+  recordId: string;
+  ownerId?: string;
+}
+
+const props = defineProps<Props>();
+
+const { api } = useApi();
+const { toast } = useToast();
+
+const loading = ref(true);
+const sharing = ref(false);
+const removing = ref<string | null>(null);
+const error = ref<string | null>(null);
+const shares = ref<any[]>([]);
+const allUsers = ref<any[]>([]);
+const showShareDialog = ref(false);
+const newShare = ref({
+  userId: '',
+  canRead: true,
+  canEdit: false,
+  canDelete: false,
+  expiresAt: '',
+});
+
+const expiresDate = ref<Date | null>(null);
+const expiresTime = ref('');
+
+// Computed property to combine date and time into ISO string
+const combinedExpiresAt = computed(() => {
+  if (!expiresDate.value) return '';
+  
+  const date = new Date(expiresDate.value);
+  if (expiresTime.value) {
+    const [hours, minutes] = expiresTime.value.split(':');
+    date.setHours(parseInt(hours), parseInt(minutes), 0, 0);
+  } else {
+    date.setHours(23, 59, 59, 999); // Default to end of day
+  }
+  
+  return date.toISOString();
+});
+
+// Filter out users who already have shares
+const availableUsers = computed(() => {
+  const sharedUserIds = new Set(shares.value.map(s => s.granteeUserId));
+  return allUsers.value.filter(u => !sharedUserIds.has(u.id));
+});
+
+const loadShares = async () => {
+  try {
+    loading.value = true;
+    error.value = null;
+    const response = await api.get(
+      `/runtime/objects/${props.objectApiName}/records/${props.recordId}/shares`
+    );
+    shares.value = response || [];
+  } catch (e: any) {
+    console.error('Failed to load shares:', e);
+    error.value = e.message || 'Failed to load shares';
+    // If user is not owner, they can't see shares
+    if (e.message?.includes('owner')) {
+      error.value = 'Only the record owner can manage sharing';
+    }
+  } finally {
+    loading.value = false;
+  }
+};
+
+const loadUsers = async () => {
+  try {
+    const response = await api.get('/setup/users');
+    allUsers.value = response || [];
+  } catch (e: any) {
+    console.error('Failed to load users:', e);
+  }
+};
+
+const createShare = async () => {
+  try {
+    sharing.value = true;
+    
+    const expiresAtValue = combinedExpiresAt.value;
+    console.log('Creating share, expiresAt value:', expiresAtValue);
+    
+    const payload: any = {
+      granteeUserId: newShare.value.userId,
+      canRead: newShare.value.canRead,
+      canEdit: newShare.value.canEdit,
+      canDelete: newShare.value.canDelete,
+    };
+    
+    // Only include expiresAt if it has a value
+    if (expiresAtValue) {
+      payload.expiresAt = expiresAtValue;
+      console.log('Including expiresAt in payload:', payload.expiresAt);
+    } else {
+      console.log('Skipping expiresAt - no date selected');
+    }
+    
+    console.log('Final payload:', payload);
+    
+    await api.post(
+      `/runtime/objects/${props.objectApiName}/records/${props.recordId}/shares`,
+      payload
+    );
+    toast.success('Record shared successfully');
+    showShareDialog.value = false;
+    newShare.value = {
+      userId: '',
+      canRead: true,
+      canEdit: false,
+      canDelete: false,
+      expiresAt: '',
+    };
+    expiresDate.value = null;
+    expiresTime.value = '';
+    await loadShares();
+  } catch (e: any) {
+    console.error('Failed to share record:', e);
+    toast.error(e.message || 'Failed to share record');
+  } finally {
+    sharing.value = false;
+  }
+};
+
+const removeShare = async (shareId: string) => {
+  try {
+    removing.value = shareId;
+    await api.delete(
+      `/runtime/objects/${props.objectApiName}/records/${props.recordId}/shares/${shareId}`
+    );
+    toast.success('Share removed successfully');
+    await loadShares();
+  } catch (e: any) {
+    console.error('Failed to remove share:', e);
+    toast.error(e.message || 'Failed to remove share');
+  } finally {
+    removing.value = null;
+  }
+};
+
+const getUserName = (user: any) => {
+  if (!user) return 'Unknown';
+  if (user.firstName || user.lastName) {
+    return [user.firstName, user.lastName].filter(Boolean).join(' ');
+  }
+  return user.email;
+};
+
+const formatDate = (date: string) => {
+  if (!date) return 'N/A';
+  return new Date(date).toLocaleDateString();
+};
+
+onMounted(async () => {
+  await Promise.all([loadShares(), loadUsers()]);
+});
+
+definePageMeta({
+  layout: 'default',
+});
+</script>

frontend/components/SoftphoneDialog.vue

@@ -0,0 +1,280 @@
+<template>
+  <Dialog v-model:open="softphone.isOpen.value">
+    <DialogContent class="sm:max-w-[500px] max-h-[80vh] overflow-hidden flex flex-col">
+      <DialogHeader>
+        <DialogTitle>Softphone</DialogTitle>
+      </DialogHeader>
+
+      <div class="flex-1 overflow-y-auto space-y-4">
+        <!-- Connection Status -->
+        <div class="flex items-center justify-between p-3 rounded-lg border" :class="{
+          'bg-green-50 border-green-200': softphone.isConnected.value,
+          'bg-red-50 border-red-200': !softphone.isConnected.value
+        }">
+          <span class="text-sm font-medium">
+            {{ softphone.isConnected.value ? 'Connected' : 'Disconnected' }}
+          </span>
+          <div class="h-2 w-2 rounded-full" :class="{
+            'bg-green-500': softphone.isConnected.value,
+            'bg-red-500': !softphone.isConnected.value
+          }"></div>
+        </div>
+
+        <!-- Incoming Call -->
+        <div v-if="softphone.incomingCall.value" class="p-4 rounded-lg border border-blue-200 bg-blue-50 animate-pulse">
+          <div class="text-center space-y-4">
+            <div>
+              <p class="text-sm text-gray-600">Incoming call from</p>
+              <p class="text-2xl font-bold">{{ formatPhoneNumber(softphone.incomingCall.value.fromNumber) }}</p>
+            </div>
+            <div class="flex gap-2 justify-center">
+              <Button @click="handleAccept" class="bg-green-500 hover:bg-green-600">
+                <PhoneIcon class="w-4 h-4 mr-2" />
+                Accept
+              </Button>
+              <Button @click="handleReject" variant="destructive">
+                <PhoneOffIcon class="w-4 h-4 mr-2" />
+                Reject
+              </Button>
+            </div>
+          </div>
+        </div>
+
+        <!-- Active Call -->
+        <div v-if="softphone.currentCall.value" class="space-y-4">
+          <div class="p-4 rounded-lg border bg-gray-50">
+            <div class="text-center space-y-2">
+              <p class="text-sm text-gray-600">
+                {{ softphone.currentCall.value.direction === 'outbound' ? 'Calling' : 'Connected with' }}
+              </p>
+              <p class="text-2xl font-bold">
+                {{ formatPhoneNumber(
+                  softphone.currentCall.value.direction === 'outbound' 
+                    ? softphone.currentCall.value.toNumber 
+                    : softphone.currentCall.value.fromNumber
+                ) }}
+              </p>
+              <p class="text-sm text-gray-500 capitalize">{{ softphone.callStatus.value }}</p>
+            </div>
+          </div>
+
+          <!-- Call Controls -->
+          <div class="grid grid-cols-3 gap-2">
+            <Button variant="outline" size="sm" @click="toggleMute">
+              <MicIcon v-if="!isMuted" class="w-4 h-4" />
+              <MicOffIcon v-else class="w-4 h-4" />
+            </Button>
+            <Button variant="outline" size="sm" @click="showDialpad = !showDialpad">
+              <Hash class="w-4 h-4" />
+            </Button>
+            <Button variant="destructive" size="sm" @click="handleEndCall">
+              <PhoneOffIcon class="w-4 h-4" />
+            </Button>
+          </div>
+
+          <!-- Dialpad -->
+          <div v-if="showDialpad" class="grid grid-cols-3 gap-2">
+            <Button
+              v-for="digit in ['1', '2', '3', '4', '5', '6', '7', '8', '9', '*', '0', '#']"
+              :key="digit"
+              variant="outline"
+              size="sm"
+              @click="handleDtmf(digit)"
+              class="h-12 text-lg font-semibold"
+            >
+              {{ digit }}
+            </Button>
+          </div>
+
+          <!-- AI Transcript -->
+          <div v-if="softphone.transcript.value.length > 0" class="space-y-2">
+            <h3 class="text-sm font-semibold">Transcript</h3>
+            <div class="max-h-40 overflow-y-auto p-3 rounded-lg border bg-gray-50 space-y-1">
+              <p
+                v-for="(item, index) in softphone.transcript.value.slice(-10)"
+                :key="index"
+                class="text-sm"
+                :class="{ 'text-gray-400': !item.isFinal }"
+              >
+                {{ item.text }}
+              </p>
+            </div>
+          </div>
+
+          <!-- AI Suggestions -->
+          <div v-if="softphone.aiSuggestions.value.length > 0" class="space-y-2">
+            <h3 class="text-sm font-semibold">AI Suggestions</h3>
+            <div class="space-y-2 max-h-32 overflow-y-auto">
+              <div
+                v-for="(suggestion, index) in softphone.aiSuggestions.value.slice(0, 5)"
+                :key="index"
+                class="p-2 rounded-lg border text-sm"
+                :class="{
+                  'bg-blue-50 border-blue-200': suggestion.type === 'response',
+                  'bg-green-50 border-green-200': suggestion.type === 'action',
+                  'bg-purple-50 border-purple-200': suggestion.type === 'insight'
+                }"
+              >
+                <span class="text-xs font-medium uppercase text-gray-600">{{ suggestion.type }}</span>
+                <p class="mt-1">{{ suggestion.text }}</p>
+              </div>
+            </div>
+          </div>
+        </div>
+
+        <!-- Dialer (when no active call) -->
+        <div v-if="!softphone.currentCall.value && !softphone.incomingCall.value" class="space-y-4">
+          <div>
+            <label class="text-sm font-medium">Phone Number</label>
+            <Input
+              v-model="phoneNumber"
+              placeholder="+1234567890"
+              class="mt-1"
+              @keyup.enter="handleCall"
+            />
+          </div>
+
+          <div class="grid grid-cols-3 gap-2">
+            <Button
+              v-for="digit in ['1', '2', '3', '4', '5', '6', '7', '8', '9', '*', '0', '#']"
+              :key="digit"
+              variant="outline"
+              @click="phoneNumber += digit"
+              class="h-12 text-lg font-semibold"
+            >
+              {{ digit }}
+            </Button>
+          </div>
+
+          <div class="flex gap-2">
+            <Button @click="handleCall" class="flex-1" :disabled="!phoneNumber">
+              <PhoneIcon class="w-4 h-4 mr-2" />
+              Call
+            </Button>
+            <Button @click="phoneNumber = ''" variant="outline">
+              <XIcon class="w-4 h-4" />
+            </Button>
+          </div>
+
+          <!-- Recent Calls -->
+          <div v-if="softphone.callHistory.value.length > 0" class="space-y-2">
+            <h3 class="text-sm font-semibold">Recent Calls</h3>
+            <div class="space-y-1 max-h-40 overflow-y-auto">
+              <div
+                v-for="call in softphone.callHistory.value.slice(0, 5)"
+                :key="call.callSid"
+                class="flex items-center justify-between p-2 rounded hover:bg-gray-100 cursor-pointer"
+                @click="phoneNumber = call.direction === 'outbound' ? call.toNumber : call.fromNumber"
+              >
+                <div class="flex items-center gap-2">
+                  <PhoneIcon v-if="call.direction === 'outbound'" class="w-3 h-3 text-green-500" />
+                  <PhoneIncomingIcon v-else class="w-3 h-3 text-blue-500" />
+                  <span class="text-sm">
+                    {{ formatPhoneNumber(call.direction === 'outbound' ? call.toNumber : call.fromNumber) }}
+                  </span>
+                </div>
+                <span class="text-xs text-gray-500">{{ formatDuration(call.duration) }}</span>
+              </div>
+            </div>
+          </div>
+        </div>
+      </div>
+    </DialogContent>
+  </Dialog>
+</template>
+
+<script setup lang="ts">
+import { ref } from 'vue';
+import { useSoftphone } from '~/composables/useSoftphone';
+import { Dialog, DialogContent, DialogHeader, DialogTitle } from '~/components/ui/dialog';
+import { Button } from '~/components/ui/button';
+import { Input } from '~/components/ui/input';
+import { PhoneIcon, PhoneOffIcon, PhoneIncomingIcon, MicIcon, MicOffIcon, Hash, XIcon } from 'lucide-vue-next';
+import { toast } from 'vue-sonner';
+
+const softphone = useSoftphone();
+
+const phoneNumber = ref('');
+const showDialpad = ref(false);
+const isMuted = ref(false);
+
+const handleCall = async () => {
+  if (!phoneNumber.value) {
+    toast.error('Please enter a phone number');
+    return;
+  }
+
+  try {
+    await softphone.initiateCall(phoneNumber.value);
+    phoneNumber.value = '';
+    toast.success('Call initiated');
+  } catch (error: any) {
+    toast.error(error.message || 'Failed to initiate call');
+  }
+};
+
+const handleAccept = async () => {
+  if (!softphone.incomingCall.value) return;
+
+  try {
+    await softphone.acceptCall(softphone.incomingCall.value.callSid);
+  } catch (error: any) {
+    toast.error(error.message || 'Failed to accept call');
+  }
+};
+
+const handleReject = async () => {
+  if (!softphone.incomingCall.value) return;
+
+  try {
+    await softphone.rejectCall(softphone.incomingCall.value.callSid);
+  } catch (error: any) {
+    toast.error(error.message || 'Failed to reject call');
+  }
+};
+
+const handleEndCall = async () => {
+  if (!softphone.currentCall.value) return;
+
+  try {
+    await softphone.endCall(softphone.currentCall.value.callSid);
+  } catch (error: any) {
+    toast.error(error.message || 'Failed to end call');
+  }
+};
+
+const handleDtmf = async (digit: string) => {
+  if (!softphone.currentCall.value) return;
+
+  try {
+    await softphone.sendDtmf(softphone.currentCall.value.callSid, digit);
+  } catch (error: any) {
+    console.error('Failed to send DTMF:', error);
+  }
+};
+
+const toggleMute = () => {
+  isMuted.value = !isMuted.value;
+  // TODO: Implement actual audio muting
+  toast.info(isMuted.value ? 'Muted' : 'Unmuted');
+};
+
+const formatPhoneNumber = (number: string): string => {
+  if (!number) return '';
+  // Simple US format
+  const cleaned = number.replace(/\D/g, '');
+  if (cleaned.length === 11 && cleaned[0] === '1') {
+    return `+1 (${cleaned.slice(1, 4)}) ${cleaned.slice(4, 7)}-${cleaned.slice(7)}`;
+  } else if (cleaned.length === 10) {
+    return `(${cleaned.slice(0, 3)}) ${cleaned.slice(3, 6)}-${cleaned.slice(6)}`;
+  }
+  return number;
+};
+
+const formatDuration = (seconds?: number): string => {
+  if (!seconds) return '--:--';
+  const mins = Math.floor(seconds / 60);
+  const secs = seconds % 60;
+  return `${mins}:${secs.toString().padStart(2, '0')}`;
+};
+</script>

frontend/components/views/DetailViewEnhanced.vue

@@ -2,9 +2,11 @@
 import { computed, ref, onMounted } from 'vue'
 import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@/components/ui/card'
 import { Button } from '@/components/ui/button'
+import { Tabs, TabsContent, TabsList, TabsTrigger } from '@/components/ui/tabs'
 import FieldRenderer from '@/components/fields/FieldRenderer.vue'
 import PageLayoutRenderer from '@/components/PageLayoutRenderer.vue'
 import RelatedList from '@/components/RelatedList.vue'
+import RecordSharing from '@/components/RecordSharing.vue'
 import { DetailViewConfig, ViewMode, FieldSection, FieldConfig, RelatedListConfig } from '@/types/field-types'
 import { Edit, Trash2, ArrowLeft } from 'lucide-vue-next'
 import {
@@ -20,11 +22,13 @@ interface Props {
   loading?: boolean
   objectId?: string // For fetching page layout
   baseUrl?: string
+  showSharing?: boolean
 }
 
 const props = withDefaults(defineProps<Props>(), {
   loading: false,
   baseUrl: '/runtime/objects',
+  showSharing: true,
 })
 
 const emit = defineEmits<{
@@ -130,8 +134,22 @@ const usePageLayout = computed(() => {
       <div class="animate-spin rounded-full h-12 w-12 border-b-2 border-primary"></div>
     </div>
 
+    <!-- Tabs for Details, Related, and Sharing -->
+    <Tabs v-else default-value="details" class="space-y-6">
+      <TabsList>
+        <TabsTrigger value="details">Details</TabsTrigger>
+        <TabsTrigger v-if="config.relatedLists && config.relatedLists.length > 0" value="related">
+          Related
+        </TabsTrigger>
+        <TabsTrigger v-if="showSharing && data.id" value="sharing">
+          Sharing
+        </TabsTrigger>
+      </TabsList>
+
+      <!-- Details Tab -->
+      <TabsContent value="details" class="space-y-6">
         <!-- Content with Page Layout -->
-    <Card v-else-if="usePageLayout">
+        <Card v-if="usePageLayout">
           <CardHeader>
             <CardTitle>Details</CardTitle>
           </CardHeader>
@@ -202,9 +220,11 @@ const usePageLayout = computed(() => {
             </template>
           </Card>
         </div>
+      </TabsContent>
 
-    <!-- Related Lists -->
-    <div v-if="config.relatedLists && config.relatedLists.length > 0" class="space-y-6">
+      <!-- Related Lists Tab -->
+      <TabsContent value="related" class="space-y-6">
+        <div v-if="config.relatedLists && config.relatedLists.length > 0">
           <RelatedList
             v-for="relatedList in config.relatedLists"
             :key="relatedList.relationName"
@@ -215,6 +235,22 @@ const usePageLayout = computed(() => {
             @create="(objectApiName, parentId) => emit('createRelated', objectApiName, parentId)"
           />
         </div>
+      </TabsContent>
+
+      <!-- Sharing Tab -->
+      <TabsContent value="sharing">
+        <Card>
+          <CardContent class="pt-6">
+            <RecordSharing
+              v-if="data.id && config.objectApiName"
+              :object-api-name="config.objectApiName"
+              :record-id="data.id"
+              :owner-id="data.ownerId"
+            />
+          </CardContent>
+        </Card>
+      </TabsContent>
+    </Tabs>
   </div>
 </template>
 

frontend/components/views/EditView.vue

@@ -137,7 +137,12 @@ const validateForm = (): boolean => {
 
 const handleSave = () => {
   if (validateForm()) {
-    emit('save', { ...formData.value })
+    // Start with props.data to preserve system fields like id, then override with user edits
+    const dataToSave = { 
+      ...props.data,
+      ...formData.value,
+    }
+    emit('save', dataToSave)
   }
 }
 

frontend/components/views/EditViewEnhanced.vue

@@ -160,11 +160,10 @@ const validateForm = (): boolean => {
 
 const handleSave = () => {
   if (validateForm()) {
-    // Filter out system fields from save data
-    const saveData = { ...formData.value }
-    const systemFields = ['id', 'tenantId', 'ownerId', 'created_at', 'updated_at', 'createdAt', 'updatedAt', 'createdBy', 'updatedBy']
-    for (const field of systemFields) {
-      delete saveData[field]
+    // Start with props.data to preserve system fields like id, then override with user edits
+    const saveData = { 
+      ...props.data,
+      ...formData.value,
     }
     emit('save', saveData)
   }

frontend/composables/useSoftphone.ts

@@ -0,0 +1,421 @@
+import { ref, computed, onMounted, onUnmounted } from 'vue';
+import { io, Socket } from 'socket.io-client';
+import { useAuth } from './useAuth';
+import { toast } from 'vue-sonner';
+
+interface Call {
+  callSid: string;
+  direction: 'inbound' | 'outbound';
+  fromNumber: string;
+  toNumber: string;
+  status: string;
+  startedAt?: string;
+  duration?: number;
+}
+
+interface CallTranscript {
+  text: string;
+  isFinal: boolean;
+  timestamp: number;
+}
+
+interface AiSuggestion {
+  type: 'response' | 'action' | 'insight';
+  text: string;
+  data?: any;
+}
+
+// Module-level shared state for global access
+const socket = ref<Socket | null>(null);
+const isConnected = ref(false);
+const isOpen = ref(false);
+const currentCall = ref<Call | null>(null);
+const incomingCall = ref<Call | null>(null);
+const transcript = ref<CallTranscript[]>([]);
+const aiSuggestions = ref<AiSuggestion[]>([]);
+const callHistory = ref<Call[]>([]);
+const isInitialized = ref(false);
+
+export function useSoftphone() {
+  const auth = useAuth();
+
+  // Get token and tenantId from localStorage
+  const getToken = () => {
+    if (typeof window === 'undefined') return null;
+    return localStorage.getItem('token');
+  };
+
+  const getTenantId = () => {
+    if (typeof window === 'undefined') return null;
+    return localStorage.getItem('tenantId');
+  };
+
+  // Computed properties
+  const isInCall = computed(() => currentCall.value !== null);
+  const hasIncomingCall = computed(() => incomingCall.value !== null);
+  const callStatus = computed(() => currentCall.value?.status || 'idle');
+
+  /**
+   * Initialize WebSocket connection
+   */
+  const connect = () => {
+    const token = getToken();
+    
+    if (socket.value?.connected || !token) {
+      return;
+    }
+
+    // Use same pattern as useApi to preserve subdomain for multi-tenant
+    const getBackendUrl = () => {
+      if (typeof window !== 'undefined') {
+        const currentHost = window.location.hostname;
+        const protocol = window.location.protocol;
+        return `${protocol}//${currentHost}:3000`;
+      }
+      return 'http://localhost:3000';
+    };
+
+    // Connect to /voice namespace
+    socket.value = io(`${getBackendUrl()}/voice`, {
+      auth: {
+        token: token,
+      },
+      transports: ['websocket', 'polling'],
+      reconnection: true,
+      reconnectionDelay: 1000,
+      reconnectionDelayMax: 5000,
+      reconnectionAttempts: 5,
+    });
+
+    // Connection events
+    socket.value.on('connect', () => {
+      console.log('Softphone WebSocket connected');
+      isConnected.value = true;
+    });
+
+    socket.value.on('disconnect', () => {
+      console.log('Softphone WebSocket disconnected');
+      isConnected.value = false;
+    });
+
+    socket.value.on('connect_error', (error) => {
+      console.error('Softphone connection error:', error);
+      toast.error('Failed to connect to voice service');
+    });
+
+    // Call events
+    socket.value.on('call:incoming', handleIncomingCall);
+    socket.value.on('call:initiated', handleCallInitiated);
+    socket.value.on('call:accepted', handleCallAccepted);
+    socket.value.on('call:rejected', handleCallRejected);
+    socket.value.on('call:ended', handleCallEnded);
+    socket.value.on('call:update', handleCallUpdate);
+    socket.value.on('call:error', handleCallError);
+    socket.value.on('call:state', handleCallState);
+
+    // AI events
+    socket.value.on('ai:transcript', handleAiTranscript);
+    socket.value.on('ai:suggestion', handleAiSuggestion);
+    socket.value.on('ai:action', handleAiAction);
+
+    isInitialized.value = true;
+  };
+
+  /**
+   * Disconnect WebSocket
+   */
+  const disconnect = () => {
+    if (socket.value) {
+      socket.value.disconnect();
+      socket.value = null;
+      isConnected.value = false;
+      isInitialized.value = false;
+    }
+  };
+
+  /**
+   * Open softphone dialog
+   */
+  const open = () => {
+    if (!isInitialized.value) {
+      connect();
+    }
+    isOpen.value = true;
+  };
+
+  /**
+   * Close softphone dialog
+   */
+  const close = () => {
+    isOpen.value = false;
+  };
+
+  /**
+   * Initiate outbound call
+   */
+  const initiateCall = async (toNumber: string) => {
+    if (!socket.value?.connected) {
+      toast.error('Not connected to voice service');
+      return;
+    }
+
+    return new Promise((resolve, reject) => {
+      socket.value!.emit('call:initiate', { toNumber }, (response: any) => {
+        if (response.success) {
+          resolve(response);
+        } else {
+          reject(new Error(response.error));
+        }
+      });
+    });
+  };
+
+  /**
+   * Accept incoming call
+   */
+  const acceptCall = async (callSid: string) => {
+    if (!socket.value?.connected) {
+      toast.error('Not connected to voice service');
+      return;
+    }
+
+    return new Promise((resolve, reject) => {
+      socket.value!.emit('call:accept', { callSid }, (response: any) => {
+        if (response.success) {
+          resolve(response);
+        } else {
+          reject(new Error(response.error));
+        }
+      });
+    });
+  };
+
+  /**
+   * Reject incoming call
+   */
+  const rejectCall = async (callSid: string) => {
+    if (!socket.value?.connected) {
+      toast.error('Not connected to voice service');
+      return;
+    }
+
+    return new Promise((resolve, reject) => {
+      socket.value!.emit('call:reject', { callSid }, (response: any) => {
+        if (response.success) {
+          resolve(response);
+        } else {
+          reject(new Error(response.error));
+        }
+      });
+    });
+  };
+
+  /**
+   * End active call
+   */
+  const endCall = async (callSid: string) => {
+    if (!socket.value?.connected) {
+      toast.error('Not connected to voice service');
+      return;
+    }
+
+    return new Promise((resolve, reject) => {
+      socket.value!.emit('call:end', { callSid }, (response: any) => {
+        if (response.success) {
+          resolve(response);
+        } else {
+          reject(new Error(response.error));
+        }
+      });
+    });
+  };
+
+  /**
+   * Send DTMF tone
+   */
+  const sendDtmf = async (callSid: string, digit: string) => {
+    if (!socket.value?.connected) {
+      return;
+    }
+
+    return new Promise((resolve, reject) => {
+      socket.value!.emit('call:dtmf', { callSid, digit }, (response: any) => {
+        if (response.success) {
+          resolve(response);
+        } else {
+          reject(new Error(response.error));
+        }
+      });
+    });
+  };
+
+  // Event handlers
+  const handleIncomingCall = (data: Call) => {
+    console.log('Incoming call:', data);
+    incomingCall.value = data;
+    isOpen.value = true;
+
+    toast.info(`Incoming call from ${data.fromNumber}`, {
+      duration: 30000,
+      action: {
+        label: 'Answer',
+        onClick: () => {
+          acceptCall(data.callSid);
+        },
+      },
+    });
+
+    // Play ringtone
+    playRingtone();
+  };
+
+  const handleCallInitiated = (data: any) => {
+    console.log('Call initiated:', data);
+    currentCall.value = {
+      callSid: data.callSid,
+      direction: 'outbound',
+      fromNumber: '',
+      toNumber: data.toNumber,
+      status: data.status,
+    };
+    transcript.value = [];
+    aiSuggestions.value = [];
+  };
+
+  const handleCallAccepted = (data: any) => {
+    console.log('Call accepted:', data);
+    if (incomingCall.value?.callSid === data.callSid) {
+      currentCall.value = incomingCall.value;
+      if (currentCall.value) {
+        currentCall.value.status = 'in-progress';
+      }
+      incomingCall.value = null;
+    }
+    stopRingtone();
+  };
+
+  const handleCallRejected = (data: any) => {
+    console.log('Call rejected:', data);
+    if (incomingCall.value?.callSid === data.callSid) {
+      incomingCall.value = null;
+    }
+    stopRingtone();
+  };
+
+  const handleCallEnded = (data: any) => {
+    console.log('Call ended:', data);
+    if (currentCall.value?.callSid === data.callSid) {
+      currentCall.value = null;
+    }
+    if (incomingCall.value?.callSid === data.callSid) {
+      incomingCall.value = null;
+    }
+    stopRingtone();
+    toast.info('Call ended');
+  };
+
+  const handleCallUpdate = (data: any) => {
+    console.log('Call update:', data);
+    if (currentCall.value?.callSid === data.callSid) {
+      currentCall.value = { ...currentCall.value, ...data };
+    }
+  };
+
+  const handleCallError = (data: any) => {
+    console.error('Call error:', data);
+    toast.error(data.message || 'Call error occurred');
+  };
+
+  const handleCallState = (data: Call) => {
+    console.log('Call state:', data);
+    if (data.status === 'in-progress') {
+      currentCall.value = data;
+    }
+  };
+
+  const handleAiTranscript = (data: { transcript: string; isFinal: boolean }) => {
+    console.log('AI transcript:', data);
+    transcript.value.push({
+      text: data.transcript,
+      isFinal: data.isFinal,
+      timestamp: Date.now(),
+    });
+
+    // Keep only last 50 transcript items
+    if (transcript.value.length > 50) {
+      transcript.value = transcript.value.slice(-50);
+    }
+  };
+
+  const handleAiSuggestion = (data: AiSuggestion) => {
+    console.log('AI suggestion:', data);
+    aiSuggestions.value.unshift(data);
+
+    // Keep only last 10 suggestions
+    if (aiSuggestions.value.length > 10) {
+      aiSuggestions.value = aiSuggestions.value.slice(0, 10);
+    }
+  };
+
+  const handleAiAction = (data: any) => {
+    console.log('AI action:', data);
+    toast.info(`AI: ${data.action}`);
+  };
+
+  // Ringtone management
+  let ringtoneAudio: HTMLAudioElement | null = null;
+
+  const playRingtone = () => {
+    try {
+      ringtoneAudio = new Audio('/ringtone.mp3');
+      ringtoneAudio.loop = true;
+      ringtoneAudio.play();
+    } catch (error) {
+      console.error('Failed to play ringtone:', error);
+    }
+  };
+
+  const stopRingtone = () => {
+    if (ringtoneAudio) {
+      ringtoneAudio.pause();
+      ringtoneAudio = null;
+    }
+  };
+
+  // Auto-connect on mount if token is available
+  onMounted(() => {
+    if (getToken() && !isInitialized.value) {
+      connect();
+    }
+  });
+
+  // Cleanup on unmount
+  onUnmounted(() => {
+    stopRingtone();
+  });
+
+  return {
+    // State
+    isOpen,
+    isConnected,
+    isInCall,
+    hasIncomingCall,
+    currentCall,
+    incomingCall,
+    callStatus,
+    transcript,
+    aiSuggestions,
+    callHistory,
+
+    // Methods
+    open,
+    close,
+    connect,
+    disconnect,
+    initiateCall,
+    acceptCall,
+    rejectCall,
+    endCall,
+    sendDtmf,
+  };
+}

frontend/layouts/default.vue

@@ -2,6 +2,7 @@
 import { ref } from 'vue'
 import AppSidebar from '@/components/AppSidebar.vue'
 import AIChatBar from '@/components/AIChatBar.vue'
+import SoftphoneDialog from '@/components/SoftphoneDialog.vue'
 import {
   Breadcrumb,
   BreadcrumbItem,
@@ -75,6 +76,9 @@ const breadcrumbs = computed(() => {
 
       <!-- AI Chat Bar Component -->
       <AIChatBar />
+
+      <!-- Softphone Dialog (Global) -->
+      <SoftphoneDialog />
     </SidebarInset>
   </SidebarProvider>
 </template>

frontend/nuxt.config.ts

@@ -67,4 +67,12 @@ export default defineNuxtConfig({
   compatibilityDate: '2024-01-01',
 
   css: ['~/assets/css/main.css'],
+
+  components: [
+    {
+      path: '~/components',
+      pathPrefix: false,
+      extensions: ['.vue'],
+    },
+  ],
 })

frontend/package-lock.json

@@ -20,6 +20,7 @@
         "radix-vue": "^1.4.1",
         "reka-ui": "^2.6.1",
         "shadcn-nuxt": "^2.3.3",
+        "socket.io-client": "^4.8.3",
         "tailwind-merge": "^2.2.1",
         "vue": "^3.4.15",
         "vue-router": "^4.2.5",
@@ -3729,6 +3730,12 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/@socket.io/component-emitter": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/@socket.io/component-emitter/-/component-emitter-3.1.2.tgz",
+      "integrity": "sha512-9BCxFwvbGg/RsZK9tjXd8s4UcwR0MWeFQ1XEKIQVVvAGJyINdrqKMcTRyLoK8Rse1GjzLV9cwjWV1olXRWEXVA==",
+      "license": "MIT"
+    },
     "node_modules/@speed-highlight/core": {
       "version": "1.2.12",
       "resolved": "https://registry.npmjs.org/@speed-highlight/core/-/core-1.2.12.tgz",
@@ -6887,6 +6894,28 @@
         "node": ">= 0.8"
       }
     },
+    "node_modules/engine.io-client": {
+      "version": "6.6.4",
+      "resolved": "https://registry.npmjs.org/engine.io-client/-/engine.io-client-6.6.4.tgz",
+      "integrity": "sha512-+kjUJnZGwzewFDw951CDWcwj35vMNf2fcj7xQWOctq1F2i1jkDdVvdFG9kM/BEChymCH36KgjnW0NsL58JYRxw==",
+      "license": "MIT",
+      "dependencies": {
+        "@socket.io/component-emitter": "~3.1.0",
+        "debug": "~4.4.1",
+        "engine.io-parser": "~5.2.1",
+        "ws": "~8.18.3",
+        "xmlhttprequest-ssl": "~2.1.1"
+      }
+    },
+    "node_modules/engine.io-parser": {
+      "version": "5.2.3",
+      "resolved": "https://registry.npmjs.org/engine.io-parser/-/engine.io-parser-5.2.3.tgz",
+      "integrity": "sha512-HqD3yTBfnBxIrbnM1DoD6Pcq8NECnh8d4As1Qgh0z5Gg3jRRIqijury0CL3ghu/edArpUYiYqQiDUQBIs4np3Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10.0.0"
+      }
+    },
     "node_modules/enhanced-resolve": {
       "version": "5.18.3",
       "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.18.3.tgz",
@@ -13938,6 +13967,34 @@
       "integrity": "sha512-g6T+p7QO8npa+/hNx9ohv1E5pVCmWrVCUzUXJyLdMmftX6ER0oiWY/w9knEonLpnOp6b6FenKnMfR8gqwWdwig==",
       "license": "MIT"
     },
+    "node_modules/socket.io-client": {
+      "version": "4.8.3",
+      "resolved": "https://registry.npmjs.org/socket.io-client/-/socket.io-client-4.8.3.tgz",
+      "integrity": "sha512-uP0bpjWrjQmUt5DTHq9RuoCBdFJF10cdX9X+a368j/Ft0wmaVgxlrjvK3kjvgCODOMMOz9lcaRzxmso0bTWZ/g==",
+      "license": "MIT",
+      "dependencies": {
+        "@socket.io/component-emitter": "~3.1.0",
+        "debug": "~4.4.1",
+        "engine.io-client": "~6.6.1",
+        "socket.io-parser": "~4.2.4"
+      },
+      "engines": {
+        "node": ">=10.0.0"
+      }
+    },
+    "node_modules/socket.io-parser": {
+      "version": "4.2.5",
+      "resolved": "https://registry.npmjs.org/socket.io-parser/-/socket.io-parser-4.2.5.tgz",
+      "integrity": "sha512-bPMmpy/5WWKHea5Y/jYAP6k74A+hvmRCQaJuJB6I/ML5JZq/KfNieUVo/3Mh7SAqn7TyFdIo6wqYHInG1MU1bQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@socket.io/component-emitter": "~3.1.0",
+        "debug": "~4.4.1"
+      },
+      "engines": {
+        "node": ">=10.0.0"
+      }
+    },
     "node_modules/source-map": {
       "version": "0.7.6",
       "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.7.6.tgz",
@@ -16344,6 +16401,14 @@
         "node": ">=12"
       }
     },
+    "node_modules/xmlhttprequest-ssl": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/xmlhttprequest-ssl/-/xmlhttprequest-ssl-2.1.2.tgz",
+      "integrity": "sha512-TEU+nJVUUnA4CYJFLvK5X9AOeH4KvDvhIfm0vV1GaQRtchnG0hgK5p8hw/xjv8cunWYCsiPCSDzObPyhEwq3KQ==",
+      "engines": {
+        "node": ">=0.4.0"
+      }
+    },
     "node_modules/y18n": {
       "version": "5.0.8",
       "resolved": "https://registry.npmjs.org/y18n/-/y18n-5.0.8.tgz",

frontend/package.json

@@ -26,6 +26,7 @@
     "radix-vue": "^1.4.1",
     "reka-ui": "^2.6.1",
     "shadcn-nuxt": "^2.3.3",
+    "socket.io-client": "^4.8.3",
     "tailwind-merge": "^2.2.1",
     "vue": "^3.4.15",
     "vue-router": "^4.2.5",

frontend/pages/settings/integrations.vue

@@ -0,0 +1,169 @@
+<template>
+  <div class="max-w-4xl mx-auto space-y-6">
+    <div>
+      <h1 class="text-3xl font-bold">Integrations</h1>
+      <p class="text-muted-foreground mt-2">
+        Configure third-party service integrations for your tenant
+      </p>
+    </div>
+
+    <!-- Twilio Configuration -->
+    <Card>
+      <CardHeader>
+        <CardTitle class="flex items-center gap-2">
+          <Phone class="w-5 h-5" />
+          Twilio Voice
+        </CardTitle>
+        <CardDescription>
+          Configure Twilio for voice calling capabilities
+        </CardDescription>
+      </CardHeader>
+      <CardContent class="space-y-4">
+        <div class="space-y-2">
+          <Label for="twilio-account-sid">Account SID</Label>
+          <Input
+            id="twilio-account-sid"
+            v-model="twilioConfig.accountSid"
+            placeholder="ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
+          />
+        </div>
+        <div class="space-y-2">
+          <Label for="twilio-auth-token">Auth Token</Label>
+          <Input
+            id="twilio-auth-token"
+            v-model="twilioConfig.authToken"
+            type="password"
+            placeholder="Enter your Twilio auth token"
+          />
+        </div>
+        <div class="space-y-2">
+          <Label for="twilio-phone-number">Phone Number</Label>
+          <Input
+            id="twilio-phone-number"
+            v-model="twilioConfig.phoneNumber"
+            placeholder="+1234567890"
+          />
+        </div>
+      </CardContent>
+    </Card>
+
+    <!-- OpenAI Configuration -->
+    <Card>
+      <CardHeader>
+        <CardTitle class="flex items-center gap-2">
+          <Bot class="w-5 h-5" />
+          OpenAI Realtime
+        </CardTitle>
+        <CardDescription>
+          Configure OpenAI for AI-assisted calling features
+        </CardDescription>
+      </CardHeader>
+      <CardContent class="space-y-4">
+        <div class="space-y-2">
+          <Label for="openai-api-key">API Key</Label>
+          <Input
+            id="openai-api-key"
+            v-model="openaiConfig.apiKey"
+            type="password"
+            placeholder="sk-..."
+          />
+        </div>
+        <div class="space-y-2">
+          <Label for="openai-model">Model</Label>
+          <Input
+            id="openai-model"
+            v-model="openaiConfig.model"
+            placeholder="gpt-4o-realtime-preview"
+          />
+          <p class="text-xs text-muted-foreground">
+            Default: gpt-4o-realtime-preview
+          </p>
+        </div>
+        <div class="space-y-2">
+          <Label for="openai-voice">Voice</Label>
+          <Input
+            id="openai-voice"
+            v-model="openaiConfig.voice"
+            placeholder="alloy"
+          />
+          <p class="text-xs text-muted-foreground">
+            Options: alloy, echo, fable, onyx, nova, shimmer
+          </p>
+        </div>
+      </CardContent>
+    </Card>
+
+    <!-- Save Button -->
+    <div class="flex justify-end">
+      <Button @click="saveConfig" :disabled="saving">
+        <Save class="w-4 h-4 mr-2" />
+        {{ saving ? 'Saving...' : 'Save Configuration' }}
+      </Button>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref, onMounted } from 'vue';
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '~/components/ui/card';
+import { Input } from '~/components/ui/input';
+import { Label } from '~/components/ui/label';
+import { Button } from '~/components/ui/button';
+import { Phone, Bot, Save } from 'lucide-vue-next';
+import { useApi } from '~/composables/useApi';
+import { toast } from 'vue-sonner';
+
+const { api } = useApi();
+
+const twilioConfig = ref({
+  accountSid: '',
+  authToken: '',
+  phoneNumber: '',
+});
+
+const openaiConfig = ref({
+  apiKey: '',
+  model: 'gpt-4o-realtime-preview',
+  voice: 'alloy',
+});
+
+const saving = ref(false);
+const loading = ref(true);
+
+onMounted(async () => {
+  try {
+    const response = await api.get('/tenant/integrations');
+    if (response.data) {
+      if (response.data.twilio) {
+        twilioConfig.value = { ...twilioConfig.value, ...response.data.twilio };
+      }
+      if (response.data.openai) {
+        openaiConfig.value = { ...openaiConfig.value, ...response.data.openai };
+      }
+    }
+  } catch (error: any) {
+    console.error('Failed to load configuration:', error);
+  } finally {
+    loading.value = false;
+  }
+});
+
+const saveConfig = async () => {
+  saving.value = true;
+
+  try {
+    const integrationsConfig = {
+      twilio: twilioConfig.value,
+      openai: openaiConfig.value,
+    };
+
+    await api.put('/tenant/integrations', { integrationsConfig });
+
+    toast.success('Configuration saved successfully');
+  } catch (error: any) {
+    toast.error(error.message || 'Failed to save configuration');
+  } finally {
+    saving.value = false;
+  }
+};
+</script>

frontend/pages/setup/objects/[apiName].vue

@@ -16,8 +16,9 @@
           <!-- Tabs -->
           <div class="mb-8">
             <Tabs v-model="activeTab" default-value="fields" class="w-full">
-              <TabsList class="grid w-full grid-cols-2 max-w-md">
+              <TabsList class="grid w-full grid-cols-3 max-w-2xl">
                 <TabsTrigger value="fields">Fields</TabsTrigger>
+                <TabsTrigger value="access">Access</TabsTrigger>
                 <TabsTrigger value="layouts">Page Layouts</TabsTrigger>
               </TabsList>
 
@@ -55,6 +56,17 @@
                 </div>
               </TabsContent>
 
+              <!-- Access Tab -->
+              <TabsContent value="access" class="mt-6">
+                <ObjectAccessSettings
+                  :object-api-name="object.apiName"
+                  :object-id="object.id"
+                  :org-wide-default="object.orgWideDefault"
+                  :fields="object.fields"
+                  @update="handleAccessUpdate"
+                />
+              </TabsContent>
+
               <!-- Page Layouts Tab -->
               <TabsContent value="layouts" class="mt-6">
                 <div v-if="!selectedLayout" class="space-y-4">
@@ -138,6 +150,7 @@ import { Plus, Trash2, ArrowLeft } from 'lucide-vue-next'
 import { Button } from '@/components/ui/button'
 import { Tabs, TabsContent, TabsList, TabsTrigger } from '@/components/ui/tabs'
 import PageLayoutEditor from '@/components/PageLayoutEditor.vue'
+import ObjectAccessSettings from '@/components/ObjectAccessSettings.vue'
 import type { PageLayout, FieldLayoutItem } from '~/types/page-layout'
 
 const route = useRoute()
@@ -247,7 +260,11 @@ watch(activeTab, (newTab) => {
     fetchLayouts()
   }
 })
-
+const handleAccessUpdate = (orgWideDefault: string) => {
+  if (object.value) {
+    object.value.orgWideDefault = orgWideDefault
+  }
+}
 onMounted(async () => {
   await fetchObject()
   // If we start on layouts tab, load them

frontend/pages/setup/roles/[id].vue

@@ -0,0 +1,231 @@
+<template>
+  <div class="min-h-screen bg-background">
+    <NuxtLayout name="default">
+      <main class="container mx-auto px-4 py-8">
+        <div class="flex items-center justify-between">
+          <div>
+            <Button variant="ghost" size="sm" @click="navigateTo('/setup/roles')" class="mb-2">
+              ← Back to Roles
+            </Button>
+        <h1 class="text-3xl font-bold">{{ role?.name || 'Role' }}</h1>
+        <p class="text-muted-foreground">{{ role?.description || 'No description' }}</p>
+      </div>
+    </div>
+
+    <div v-if="loading" class="flex items-center justify-center py-12">
+      <div class="animate-spin rounded-full h-8 w-8 border-b-2 border-primary"></div>
+    </div>
+
+    <Tabs v-else default-value="details" class="w-full">
+      <TabsList>
+        <TabsTrigger value="details">Details</TabsTrigger>
+        <TabsTrigger value="users">Users</TabsTrigger>
+      </TabsList>
+
+      <TabsContent value="details" class="mt-6">
+        <Card>
+          <CardHeader>
+            <CardTitle>Role Information</CardTitle>
+          </CardHeader>
+          <CardContent class="space-y-4">
+            <div class="grid grid-cols-2 gap-4">
+              <div>
+                <Label class="text-muted-foreground">Name</Label>
+                <p class="font-medium">{{ role?.name }}</p>
+              </div>
+              <div>
+                <Label class="text-muted-foreground">Guard</Label>
+                <Badge variant="outline">{{ role?.guardName || 'tenant' }}</Badge>
+              </div>
+              <div class="col-span-2">
+                <Label class="text-muted-foreground">Description</Label>
+                <p class="font-medium">{{ role?.description || 'No description' }}</p>
+              </div>
+              <div>
+                <Label class="text-muted-foreground">Created At</Label>
+                <p class="font-medium">{{ formatDate(role?.createdAt) }}</p>
+              </div>
+              <div>
+                <Label class="text-muted-foreground">Updated At</Label>
+                <p class="font-medium">{{ formatDate(role?.updatedAt) }}</p>
+              </div>
+            </div>
+          </CardContent>
+        </Card>
+      </TabsContent>
+
+      <TabsContent value="users" class="mt-6">
+        <Card>
+          <CardHeader>
+            <div class="flex items-center justify-between">
+              <div>
+                <CardTitle>Assigned Users</CardTitle>
+                <CardDescription>Manage user assignments for this role</CardDescription>
+              </div>
+              <Button @click="showAddUserDialog = true" size="sm">
+                <Plus class="mr-2 h-4 w-4" />
+                Add User
+              </Button>
+            </div>
+          </CardHeader>
+          <CardContent>
+            <div v-if="roleUsers.length === 0" class="text-center py-8 text-muted-foreground">
+              No users assigned. Add users to grant them this role.
+            </div>
+            <div v-else class="space-y-2">
+              <div 
+                v-for="user in roleUsers" 
+                :key="user.id"
+                class="flex items-center justify-between p-3 border rounded-lg"
+              >
+                <div>
+                  <p class="font-medium">{{ getUserName(user) }}</p>
+                  <p class="text-sm text-muted-foreground">{{ user.email }}</p>
+                </div>
+                <Button variant="ghost" size="sm" @click="removeUser(user.id)">
+                  <X class="h-4 w-4" />
+                </Button>
+              </div>
+            </div>
+          </CardContent>
+        </Card>
+      </TabsContent>
+    </Tabs>
+
+    <!-- Add User Dialog -->
+    <Dialog v-model:open="showAddUserDialog">
+      <DialogContent>
+        <DialogHeader>
+          <DialogTitle>Add User</DialogTitle>
+          <DialogDescription>
+            Select a user to assign this role
+          </DialogDescription>
+        </DialogHeader>
+        <div class="space-y-4">
+          <div class="space-y-2">
+            <Label>Available Users</Label>
+            <Select v-model="selectedUserId" @update:model-value="(value) => selectedUserId = value">
+              <SelectTrigger>
+                <SelectValue placeholder="Choose a user" />
+              </SelectTrigger>
+              <SelectContent>
+                <SelectItem v-for="user in availableUsers" :key="user.id" :value="user.id">
+                  {{ getUserName(user) }} ({{ user.email }})
+                </SelectItem>
+              </SelectContent>
+            </Select>
+          </div>
+        </div>
+        <DialogFooter>
+          <Button variant="outline" @click="showAddUserDialog = false">Cancel</Button>
+          <Button @click="addUser" :disabled="!selectedUserId">
+            Add User
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+      </main>
+    </NuxtLayout>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref, onMounted, computed } from 'vue';
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '~/components/ui/card';
+import { Button } from '~/components/ui/button';
+import { Tabs, TabsContent, TabsList, TabsTrigger } from '~/components/ui/tabs';
+import { Dialog, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle } from '~/components/ui/dialog';
+import { Label } from '~/components/ui/label';
+import { Badge } from '~/components/ui/badge';
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '~/components/ui/select';
+import { Plus, X } from 'lucide-vue-next';
+
+definePageMeta({
+  layout: 'default',
+});
+
+const route = useRoute();
+const { api } = useApi();
+const { toast } = useToast();
+
+const loading = ref(true);
+const role = ref<any>(null);
+const roleUsers = ref<any[]>([]);
+const allUsers = ref<any[]>([]);
+const showAddUserDialog = ref(false);
+const selectedUserId = ref('');
+
+const availableUsers = computed(() => {
+  const assignedIds = new Set(roleUsers.value.map(u => u.id));
+  return allUsers.value.filter(u => !assignedIds.has(u.id));
+});
+
+const loadRole = async () => {
+  try {
+    loading.value = true;
+    const roleId = route.params.id;
+    const response = await api.get(`/setup/roles/${roleId}`);
+    role.value = response;
+    roleUsers.value = response.users || [];
+  } catch (error: any) {
+    console.error('Failed to load role:', error);
+    toast.error('Failed to load role');
+  } finally {
+    loading.value = false;
+  }
+};
+
+const loadAllUsers = async () => {
+  try {
+    const response = await api.get('/setup/users');
+    allUsers.value = response || [];
+  } catch (error: any) {
+    console.error('Failed to load users:', error);
+  }
+};
+
+const addUser = async () => {
+  if (!selectedUserId.value) return;
+  
+  try {
+    await api.post(`/setup/roles/${route.params.id}/users`, {
+      userId: selectedUserId.value,
+    });
+    toast.success('User added successfully');
+    showAddUserDialog.value = false;
+    selectedUserId.value = '';
+    await loadRole();
+  } catch (error: any) {
+    console.error('Failed to add user:', error);
+    toast.error(error.message || 'Failed to add user');
+  }
+};
+
+const removeUser = async (userId: string) => {
+  try {
+    await api.delete(`/setup/roles/${route.params.id}/users/${userId}`);
+    toast.success('User removed successfully');
+    await loadRole();
+  } catch (error: any) {
+    console.error('Failed to remove user:', error);
+    toast.error(error.message || 'Failed to remove user');
+  }
+};
+
+const getUserName = (user: any) => {
+  if (!user) return 'Unknown';
+  if (user.firstName || user.lastName) {
+    return [user.firstName, user.lastName].filter(Boolean).join(' ');
+  }
+  return user.email || 'Unknown';
+};
+
+const formatDate = (date: string) => {
+  if (!date) return 'N/A';
+  return new Date(date).toLocaleDateString();
+};
+
+onMounted(async () => {
+  await Promise.all([loadRole(), loadAllUsers()]);
+});
+</script>

frontend/pages/setup/roles/index.vue

@@ -0,0 +1,285 @@
+<template>
+  <div class="min-h-screen bg-background">
+    <NuxtLayout name="default">
+      <main class="container mx-auto px-4 py-8">
+        <div class="flex items-center justify-between">
+          <div>
+            <h1 class="text-3xl font-bold">Roles</h1>
+            <p class="text-muted-foreground">Manage roles and permissions</p>
+          </div>
+      <Button @click="showCreateDialog = true">
+        <Plus class="mr-2 h-4 w-4" />
+        New Role
+      </Button>
+    </div>
+
+    <div class="border rounded-lg">
+      <Table>
+        <TableHeader>
+          <TableRow>
+            <TableHead>Name</TableHead>
+            <TableHead>Description</TableHead>
+            <TableHead>Guard</TableHead>
+            <TableHead>Users</TableHead>
+            <TableHead>Created</TableHead>
+            <TableHead class="text-right">Actions</TableHead>
+          </TableRow>
+        </TableHeader>
+        <TableBody>
+          <TableRow v-if="loading">
+            <TableCell :colspan="6" class="text-center py-8">
+              <div class="flex items-center justify-center">
+                <div class="animate-spin rounded-full h-8 w-8 border-b-2 border-primary"></div>
+              </div>
+            </TableCell>
+          </TableRow>
+          <TableRow v-else-if="roles.length === 0">
+            <TableCell :colspan="6" class="text-center py-8 text-muted-foreground">
+              No roles found. Create your first role to get started.
+            </TableCell>
+          </TableRow>
+          <TableRow v-else v-for="role in roles" :key="role.id" class="cursor-pointer hover:bg-muted/50" @click="navigateTo(`/setup/roles/${role.id}`)">
+            <TableCell class="font-medium">{{ role.name }}</TableCell>
+            <TableCell>{{ role.description || 'No description' }}</TableCell>
+            <TableCell>
+              <Badge variant="outline">{{ role.guardName || 'tenant' }}</Badge>
+            </TableCell>
+            <TableCell>
+              {{ role.userCount || 0 }} users
+            </TableCell>
+            <TableCell>{{ formatDate(role.createdAt) }}</TableCell>
+            <TableCell class="text-right" @click.stop>
+              <div class="flex items-center justify-end gap-1">
+                <Button variant="ghost" size="icon" @click="navigateTo(`/setup/roles/${role.id}`)">
+                  <Eye class="h-4 w-4" />
+                </Button>
+                <Button variant="ghost" size="icon" @click="openEditDialog(role)">
+                  <Edit class="h-4 w-4" />
+                </Button>
+                <Button variant="ghost" size="icon" @click="openDeleteDialog(role)">
+                  <Trash2 class="h-4 w-4" />
+                </Button>
+              </div>
+            </TableCell>
+          </TableRow>
+        </TableBody>
+      </Table>
+    </div>
+
+    <!-- Create Role Dialog -->
+    <Dialog v-model:open="showCreateDialog">
+      <DialogContent>
+        <DialogHeader>
+          <DialogTitle>Create New Role</DialogTitle>
+          <DialogDescription>
+            Add a new role to the system
+          </DialogDescription>
+        </DialogHeader>
+        <div class="space-y-4">
+          <div class="space-y-2">
+            <Label for="name">Name</Label>
+            <Input id="name" v-model="newRole.name" placeholder="Sales Manager" />
+          </div>
+          <div class="space-y-2">
+            <Label for="description">Description (Optional)</Label>
+            <Input id="description" v-model="newRole.description" placeholder="Manages sales team and deals" />
+          </div>
+          <div class="space-y-2">
+            <Label for="guardName">Guard Name</Label>
+            <Select v-model="newRole.guardName" @update:model-value="(value) => newRole.guardName = value">
+              <SelectTrigger>
+                <SelectValue placeholder="Select guard" />
+              </SelectTrigger>
+              <SelectContent>
+                <SelectItem value="tenant">Tenant</SelectItem>
+                <SelectItem value="central">Central</SelectItem>
+              </SelectContent>
+            </Select>
+          </div>
+        </div>
+        <DialogFooter>
+          <Button variant="outline" @click="showCreateDialog = false">Cancel</Button>
+          <Button @click="createRole" :disabled="!newRole.name">
+            Create Role
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+
+    <!-- Edit Role Dialog -->
+    <Dialog v-model:open="showEditDialog">
+      <DialogContent>
+        <DialogHeader>
+          <DialogTitle>Edit Role</DialogTitle>
+          <DialogDescription>
+            Update role information
+          </DialogDescription>
+        </DialogHeader>
+        <div class="space-y-4">
+          <div class="space-y-2">
+            <Label for="edit-name">Name</Label>
+            <Input id="edit-name" v-model="editRole.name" placeholder="Role name" />
+          </div>
+          <div class="space-y-2">
+            <Label for="edit-description">Description</Label>
+            <Input id="edit-description" v-model="editRole.description" placeholder="Role description" />
+          </div>
+          <div class="space-y-2">
+            <Label for="edit-guardName">Guard Name</Label>
+            <Select v-model="editRole.guardName" @update:model-value="(value) => editRole.guardName = value">
+              <SelectTrigger>
+                <SelectValue placeholder="Select guard" />
+              </SelectTrigger>
+              <SelectContent>
+                <SelectItem value="tenant">Tenant</SelectItem>
+                <SelectItem value="central">Central</SelectItem>
+              </SelectContent>
+            </Select>
+          </div>
+        </div>
+        <DialogFooter>
+          <Button variant="outline" @click="showEditDialog = false">Cancel</Button>
+          <Button @click="updateRole" :disabled="!editRole.name">
+            Update Role
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+
+    <!-- Delete Confirmation Dialog -->
+    <Dialog v-model:open="showDeleteDialog">
+      <DialogContent>
+        <DialogHeader>
+          <DialogTitle>Delete Role</DialogTitle>
+          <DialogDescription>
+            Are you sure you want to delete this role? This action cannot be undone.
+          </DialogDescription>
+        </DialogHeader>
+        <DialogFooter>
+          <Button variant="outline" @click="showDeleteDialog = false">Cancel</Button>
+          <Button variant="destructive" @click="deleteRole">
+            Delete Role
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+      </main>
+    </NuxtLayout>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref, onMounted } from 'vue';
+import { Button } from '~/components/ui/button';
+import { Table, TableBody, TableCell, TableHead, TableHeader, TableRow } from '~/components/ui/table';
+import { Dialog, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle } from '~/components/ui/dialog';
+import { Input } from '~/components/ui/input';
+import { Label } from '~/components/ui/label';
+import { Badge } from '~/components/ui/badge';
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '~/components/ui/select';
+import { Plus, Eye, Edit, Trash2 } from 'lucide-vue-next';
+
+definePageMeta({
+  layout: 'default',
+});
+
+const { api } = useApi();
+const { toast } = useToast();
+
+const loading = ref(true);
+const roles = ref<any[]>([]);
+const showCreateDialog = ref(false);
+const showEditDialog = ref(false);
+const showDeleteDialog = ref(false);
+const newRole = ref({
+  name: '',
+  description: '',
+  guardName: 'tenant',
+});
+const editRole = ref({
+  id: '',
+  name: '',
+  description: '',
+  guardName: 'tenant',
+});
+const roleToDelete = ref<any>(null);
+
+const loadRoles = async () => {
+  try {
+    loading.value = true;
+    const response = await api.get('/setup/roles');
+    roles.value = response || [];
+  } catch (error: any) {
+    console.error('Failed to load roles:', error);
+    toast.error('Failed to load roles');
+  } finally {
+    loading.value = false;
+  }
+};
+
+const createRole = async () => {
+  try {
+    await api.post('/setup/roles', newRole.value);
+    toast.success('Role created successfully');
+    showCreateDialog.value = false;
+    newRole.value = { name: '', description: '', guardName: 'tenant' };
+    await loadRoles();
+  } catch (error: any) {
+    console.error('Failed to create role:', error);
+    toast.error(error.message || 'Failed to create role');
+  }
+};
+
+const openEditDialog = (role: any) => {
+  editRole.value = {
+    id: role.id,
+    name: role.name,
+    description: role.description || '',
+    guardName: role.guardName || 'tenant',
+  };
+  showEditDialog.value = true;
+};
+
+const updateRole = async () => {
+  try {
+    await api.patch(`/setup/roles/${editRole.value.id}`, {
+      name: editRole.value.name,
+      description: editRole.value.description,
+      guardName: editRole.value.guardName,
+    });
+    toast.success('Role updated successfully');
+    showEditDialog.value = false;
+    await loadRoles();
+  } catch (error: any) {
+    console.error('Failed to update role:', error);
+    toast.error(error.message || 'Failed to update role');
+  }
+};
+
+const openDeleteDialog = (role: any) => {
+  roleToDelete.value = role;
+  showDeleteDialog.value = true;
+};
+
+const deleteRole = async () => {
+  try {
+    await api.delete(`/setup/roles/${roleToDelete.value.id}`);
+    toast.success('Role deleted successfully');
+    showDeleteDialog.value = false;
+    roleToDelete.value = null;
+    await loadRoles();
+  } catch (error: any) {
+    console.error('Failed to delete role:', error);
+    toast.error(error.message || 'Failed to delete role');
+  }
+};
+
+const formatDate = (date: string) => {
+  if (!date) return 'N/A';
+  return new Date(date).toLocaleDateString();
+};
+
+onMounted(() => {
+  loadRoles();
+});
+</script>

frontend/pages/setup/users/[id].vue

@@ -0,0 +1,227 @@
+<template>
+  <div class="min-h-screen bg-background">
+    <NuxtLayout name="default">
+        <main class="container mx-auto px-4 py-8">
+    <div class="flex items-center justify-between">
+      <div>
+        <Button variant="ghost" size="sm" @click="navigateTo('/setup/users')" class="mb-2">
+          ← Back to Users
+        </Button>
+        <h1 class="text-3xl font-bold">{{ getUserName(user) }}</h1>
+        <p class="text-muted-foreground">{{ user?.email }}</p>
+      </div>
+    </div>
+
+    <div v-if="loading" class="flex items-center justify-center py-12">
+      <div class="animate-spin rounded-full h-8 w-8 border-b-2 border-primary"></div>
+    </div>
+
+    <Tabs v-else default-value="details" class="w-full">
+      <TabsList>
+        <TabsTrigger value="details">Details</TabsTrigger>
+        <TabsTrigger value="roles">Roles</TabsTrigger>
+      </TabsList>
+
+      <TabsContent value="details" class="mt-6">
+        <Card>
+          <CardHeader>
+            <CardTitle>User Information</CardTitle>
+          </CardHeader>
+          <CardContent class="space-y-4">
+            <div class="grid grid-cols-2 gap-4">
+              <div>
+                <Label class="text-muted-foreground">Email</Label>
+                <p class="font-medium">{{ user?.email }}</p>
+              </div>
+              <div>
+                <Label class="text-muted-foreground">First Name</Label>
+                <p class="font-medium">{{ user?.firstName || 'N/A' }}</p>
+              </div>
+              <div>
+                <Label class="text-muted-foreground">Last Name</Label>
+                <p class="font-medium">{{ user?.lastName || 'N/A' }}</p>
+              </div>
+              <div>
+                <Label class="text-muted-foreground">Created At</Label>
+                <p class="font-medium">{{ formatDate(user?.createdAt) }}</p>
+              </div>
+              <div>
+                <Label class="text-muted-foreground">Updated At</Label>
+                <p class="font-medium">{{ formatDate(user?.updatedAt) }}</p>
+              </div>
+            </div>
+          </CardContent>
+        </Card>
+      </TabsContent>
+
+      <TabsContent value="roles" class="mt-6">
+        <Card>
+          <CardHeader>
+            <div class="flex items-center justify-between">
+              <div>
+                <CardTitle>Assigned Roles</CardTitle>
+                <CardDescription>Manage role assignments for this user</CardDescription>
+              </div>
+              <Button @click="showAddRoleDialog = true" size="sm">
+                <Plus class="mr-2 h-4 w-4" />
+                Add Role
+              </Button>
+            </div>
+          </CardHeader>
+          <CardContent>
+            <div v-if="userRoles.length === 0" class="text-center py-8 text-muted-foreground">
+              No roles assigned. Add roles to grant permissions.
+            </div>
+            <div v-else class="space-y-2">
+              <div 
+                v-for="role in userRoles" 
+                :key="role.id"
+                class="flex items-center justify-between p-3 border rounded-lg"
+              >
+                <div>
+                  <p class="font-medium">{{ role.name }}</p>
+                  <p class="text-sm text-muted-foreground">{{ role.description || 'No description' }}</p>
+                </div>
+                <Button variant="ghost" size="sm" @click="removeRole(role.id)">
+                  <X class="h-4 w-4" />
+                </Button>
+              </div>
+            </div>
+          </CardContent>
+        </Card>
+      </TabsContent>
+    </Tabs>
+
+    <!-- Add Role Dialog -->
+    <Dialog v-model:open="showAddRoleDialog">
+      <DialogContent>
+        <DialogHeader>
+          <DialogTitle>Add Role</DialogTitle>
+          <DialogDescription>
+            Select a role to assign to this user
+          </DialogDescription>
+        </DialogHeader>
+        <div class="space-y-4">
+          <div class="space-y-2">
+            <Label>Available Roles</Label>
+            <Select v-model="selectedRoleId" @update:model-value="(value) => selectedRoleId = value">
+              <SelectTrigger>
+                <SelectValue placeholder="Choose a role" />
+              </SelectTrigger>
+              <SelectContent>
+                <SelectItem v-for="role in availableRoles" :key="role.id" :value="role.id">
+                  {{ role.name }}
+                </SelectItem>
+              </SelectContent>
+            </Select>
+          </div>
+        </div>
+        <DialogFooter>
+          <Button variant="outline" @click="showAddRoleDialog = false">Cancel</Button>
+          <Button @click="addRole" :disabled="!selectedRoleId">
+            Add Role
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  </main>
+    </NuxtLayout>
+    </div>
+</template>
+
+<script setup lang="ts">
+import { ref, onMounted, computed } from 'vue';
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '~/components/ui/card';
+import { Button } from '~/components/ui/button';
+import { Tabs, TabsContent, TabsList, TabsTrigger } from '~/components/ui/tabs';
+import { Dialog, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle } from '~/components/ui/dialog';
+import { Label } from '~/components/ui/label';
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '~/components/ui/select';
+import { Plus, X } from 'lucide-vue-next';
+
+
+const route = useRoute();
+const { api } = useApi();
+const { toast } = useToast();
+
+const loading = ref(true);
+const user = ref<any>(null);
+const userRoles = ref<any[]>([]);
+const allRoles = ref<any[]>([]);
+const showAddRoleDialog = ref(false);
+const selectedRoleId = ref('');
+
+const availableRoles = computed(() => {
+  const assignedIds = new Set(userRoles.value.map(r => r.id));
+  return allRoles.value.filter(r => !assignedIds.has(r.id));
+});
+
+const loadUser = async () => {
+  try {
+    loading.value = true;
+    const userId = route.params.id;
+    const response = await api.get(`/setup/users/${userId}`);
+    user.value = response;
+    userRoles.value = response.roles || [];
+  } catch (error: any) {
+    console.error('Failed to load user:', error);
+    toast.error('Failed to load user');
+  } finally {
+    loading.value = false;
+  }
+};
+
+const loadAllRoles = async () => {
+  try {
+    const response = await api.get('/setup/roles');
+    allRoles.value = response || [];
+  } catch (error: any) {
+    console.error('Failed to load roles:', error);
+  }
+};
+
+const addRole = async () => {
+  if (!selectedRoleId.value) return;
+  
+  try {
+    await api.post(`/setup/users/${route.params.id}/roles`, {
+      roleId: selectedRoleId.value,
+    });
+    toast.success('Role added successfully');
+    showAddRoleDialog.value = false;
+    selectedRoleId.value = '';
+    await loadUser();
+  } catch (error: any) {
+    console.error('Failed to add role:', error);
+    toast.error(error.message || 'Failed to add role');
+  }
+};
+
+const removeRole = async (roleId: string) => {
+  try {
+    await api.delete(`/setup/users/${route.params.id}/roles/${roleId}`);
+    toast.success('Role removed successfully');
+    await loadUser();
+  } catch (error: any) {
+    console.error('Failed to remove role:', error);
+    toast.error(error.message || 'Failed to remove role');
+  }
+};
+
+const getUserName = (user: any) => {
+  if (!user) return 'User';
+  if (user.firstName || user.lastName) {
+    return [user.firstName, user.lastName].filter(Boolean).join(' ');
+  }
+  return user.email || 'User';
+};
+
+const formatDate = (date: string) => {
+  if (!date) return 'N/A';
+  return new Date(date).toLocaleDateString();
+};
+
+onMounted(async () => {
+  await Promise.all([loadUser(), loadAllRoles()]);
+});
+</script>

frontend/pages/setup/users/index.vue

@@ -0,0 +1,290 @@
+<template>
+    <div class="min-h-screen bg-background">
+    <NuxtLayout name="default">
+        <main class="container mx-auto px-4 py-8">
+            <div class="flex items-center justify-between">
+            <div>
+                <h1 class="text-3xl font-bold">Users</h1>
+                <p class="text-muted-foreground">Manage user accounts and access</p>
+            </div>
+            <Button @click="showCreateDialog = true">
+                <UserPlus class="mr-2 h-4 w-4" />
+                New User
+            </Button>
+            </div>
+
+            <div class="border rounded-lg">
+              <Table>
+                <TableHeader>
+                  <TableRow>
+                    <TableHead>Name</TableHead>
+                    <TableHead>Email</TableHead>
+                    <TableHead>Roles</TableHead>
+                    <TableHead>Created</TableHead>
+                    <TableHead class="text-right">Actions</TableHead>
+                  </TableRow>
+                </TableHeader>
+                <TableBody>
+                  <TableRow v-if="loading">
+                    <TableCell :colspan="5" class="text-center py-8">
+                      <div class="flex items-center justify-center">
+                        <div class="animate-spin rounded-full h-8 w-8 border-b-2 border-primary"></div>
+                      </div>
+                    </TableCell>
+                  </TableRow>
+                  <TableRow v-else-if="users.length === 0">
+                    <TableCell :colspan="5" class="text-center py-8 text-muted-foreground">
+                      No users found. Create your first user to get started.
+                    </TableCell>
+                  </TableRow>
+                  <TableRow v-else v-for="user in users" :key="user.id" class="cursor-pointer hover:bg-muted/50" @click="navigateTo(`/setup/users/${user.id}`)">
+                    <TableCell class="font-medium">{{ getUserName(user) }}</TableCell>
+                    <TableCell>{{ user.email }}</TableCell>
+                    <TableCell>
+                        <div class="flex gap-1 flex-wrap">
+                        <Badge v-for="role in user.roles" :key="role.id" variant="secondary">
+                            {{ role.name }}
+                        </Badge>
+                        <span v-if="!user.roles || user.roles.length === 0" class="text-muted-foreground text-sm">
+                            No roles
+                        </span>
+                        </div>
+                    </TableCell>
+                    <TableCell>{{ formatDate(user.createdAt) }}</TableCell>
+                    <TableCell class="text-right" @click.stop>
+                        <div class="flex items-center justify-end gap-1">
+                          <Button variant="ghost" size="icon" @click="navigateTo(`/setup/users/${user.id}`)">
+                            <Eye class="h-4 w-4" />
+                          </Button>
+                          <Button variant="ghost" size="icon" @click="openEditDialog(user)">
+                            <Edit class="h-4 w-4" />
+                          </Button>
+                          <Button variant="ghost" size="icon" @click="openDeleteDialog(user)">
+                            <Trash2 class="h-4 w-4" />
+                          </Button>
+                        </div>
+                    </TableCell>
+                    </TableRow>
+                </TableBody>
+              </Table>
+            </div>
+
+            <!-- Create User Dialog -->
+            <Dialog v-model:open="showCreateDialog">
+            <DialogContent>
+                <DialogHeader>
+                <DialogTitle>Create New User</DialogTitle>
+                <DialogDescription>
+                    Add a new user to the system
+                </DialogDescription>
+                </DialogHeader>
+                <div class="space-y-4">
+                <div class="space-y-2">
+                    <Label for="email">Email</Label>
+                    <Input id="email" v-model="newUser.email" type="email" placeholder="user@example.com" />
+                </div>
+                <div class="space-y-2">
+                    <Label for="password">Password</Label>
+                    <Input id="password" v-model="newUser.password" type="password" placeholder="••••••••" />
+                </div>
+                <div class="space-y-2">
+                    <Label for="firstName">First Name (Optional)</Label>
+                    <Input id="firstName" v-model="newUser.firstName" placeholder="John" />
+                </div>
+                <div class="space-y-2">
+                    <Label for="lastName">Last Name (Optional)</Label>
+                    <Input id="lastName" v-model="newUser.lastName" placeholder="Doe" />
+                </div>
+                </div>
+                <DialogFooter>
+                <Button variant="outline" @click="showCreateDialog = false">Cancel</Button>
+                <Button @click="createUser" :disabled="!newUser.email || !newUser.password">
+                    Create User
+                </Button>
+                </DialogFooter>
+            </DialogContent>
+            </Dialog>
+
+            <!-- Edit User Dialog -->
+            <Dialog v-model:open="showEditDialog">
+            <DialogContent>
+                <DialogHeader>
+                <DialogTitle>Edit User</DialogTitle>
+                <DialogDescription>
+                    Update user information
+                </DialogDescription>
+                </DialogHeader>
+                <div class="space-y-4">
+                <div class="space-y-2">
+                    <Label for="edit-email">Email</Label>
+                    <Input id="edit-email" v-model="editUser.email" type="email" placeholder="user@example.com" />
+                </div>
+                <div class="space-y-2">
+                    <Label for="edit-password">Password (leave blank to keep current)</Label>
+                    <Input id="edit-password" v-model="editUser.password" type="password" placeholder="••••••••" />
+                </div>
+                <div class="space-y-2">
+                    <Label for="edit-firstName">First Name</Label>
+                    <Input id="edit-firstName" v-model="editUser.firstName" placeholder="John" />
+                </div>
+                <div class="space-y-2">
+                    <Label for="edit-lastName">Last Name</Label>
+                    <Input id="edit-lastName" v-model="editUser.lastName" placeholder="Doe" />
+                </div>
+                </div>
+                <DialogFooter>
+                <Button variant="outline" @click="showEditDialog = false">Cancel</Button>
+                <Button @click="updateUser" :disabled="!editUser.email">
+                    Update User
+                </Button>
+                </DialogFooter>
+            </DialogContent>
+            </Dialog>
+
+            <!-- Delete Confirmation Dialog -->
+            <Dialog v-model:open="showDeleteDialog">
+            <DialogContent>
+                <DialogHeader>
+                <DialogTitle>Delete User</DialogTitle>
+                <DialogDescription>
+                    Are you sure you want to delete this user? This action cannot be undone.
+                </DialogDescription>
+                </DialogHeader>
+                <DialogFooter>
+                <Button variant="outline" @click="showDeleteDialog = false">Cancel</Button>
+                <Button variant="destructive" @click="deleteUser">
+                    Delete User
+                </Button>
+                </DialogFooter>
+            </DialogContent>
+            </Dialog>
+        </main>
+    </NuxtLayout>
+    </div>
+</template>
+
+<script setup lang="ts">
+import { ref, onMounted } from 'vue';
+import { Button } from '~/components/ui/button';
+import { Table, TableBody, TableCell, TableHead, TableHeader, TableRow } from '~/components/ui/table';
+import { Dialog, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle } from '~/components/ui/dialog';
+import { Input } from '~/components/ui/input';
+import { Label } from '~/components/ui/label';
+import { Badge } from '~/components/ui/badge';
+import { UserPlus, Eye, Edit, Trash2 } from 'lucide-vue-next';
+
+
+const { api } = useApi();
+const { toast } = useToast();
+
+const loading = ref(true);
+const users = ref<any[]>([]);
+const showCreateDialog = ref(false);
+const showEditDialog = ref(false);
+const showDeleteDialog = ref(false);
+const newUser = ref({
+  email: '',
+  password: '',
+  firstName: '',
+  lastName: '',
+});
+const editUser = ref({
+  id: '',
+  email: '',
+  password: '',
+  firstName: '',
+  lastName: '',
+});
+const userToDelete = ref<any>(null);
+
+const loadUsers = async () => {
+  try {
+    loading.value = true;
+    const response = await api.get('/setup/users');
+    users.value = response || [];
+  } catch (error: any) {
+    console.error('Failed to load users:', error);
+    toast.error('Failed to load users');
+  } finally {
+    loading.value = false;
+  }
+};
+
+const createUser = async () => {
+  try {
+    await api.post('/setup/users', newUser.value);
+    toast.success('User created successfully');
+    showCreateDialog.value = false;
+    newUser.value = { email: '', password: '', firstName: '', lastName: '' };
+    await loadUsers();
+  } catch (error: any) {
+    console.error('Failed to create user:', error);
+    toast.error(error.message || 'Failed to create user');
+  }
+};
+
+const openEditDialog = (user: any) => {
+  editUser.value = {
+    id: user.id,
+    email: user.email,
+    password: '',
+    firstName: user.firstName || '',
+    lastName: user.lastName || '',
+  };
+  showEditDialog.value = true;
+};
+
+const updateUser = async () => {
+  try {
+    const payload: any = {
+      email: editUser.value.email,
+      firstName: editUser.value.firstName,
+      lastName: editUser.value.lastName,
+    };
+    if (editUser.value.password) {
+      payload.password = editUser.value.password;
+    }
+    await api.patch(`/setup/users/${editUser.value.id}`, payload);
+    toast.success('User updated successfully');
+    showEditDialog.value = false;
+    await loadUsers();
+  } catch (error: any) {
+    console.error('Failed to update user:', error);
+    toast.error(error.message || 'Failed to update user');
+  }
+};
+
+const openDeleteDialog = (user: any) => {
+  userToDelete.value = user;
+  showDeleteDialog.value = true;
+};
+
+const deleteUser = async () => {
+  try {
+    await api.delete(`/setup/users/${userToDelete.value.id}`);
+    toast.success('User deleted successfully');
+    showDeleteDialog.value = false;
+    userToDelete.value = null;
+    await loadUsers();
+  } catch (error: any) {
+    console.error('Failed to delete user:', error);
+    toast.error(error.message || 'Failed to delete user');
+  }
+};
+
+const getUserName = (user: any) => {
+  if (user.firstName || user.lastName) {
+    return [user.firstName, user.lastName].filter(Boolean).join(' ');
+  }
+  return user.email;
+};
+
+const formatDate = (date: string) => {
+  if (!date) return 'N/A';
+  return new Date(date).toLocaleDateString();
+};
+
+onMounted(() => {
+  loadUsers();
+});
+</script>

infra/docker-compose.yml

@@ -49,8 +49,8 @@ services:
       MYSQL_PASSWORD: platform
     ports:
       - "3306:3306"
-    ##volumes:
-    ##- percona-data:/var/lib/mysql
+    volumes:
+      - percona-data:/var/lib/mysql
     networks:
       - platform-network